2

A bloom filter can incur FPs (False-positives) but will never incur an FN (False negatives).

If the ssdeep value of two files are pretty close to each other, is it guaranteed that the file contents are pretty close to each other? Or is it that when ssdeep is completely dissimilar there is no chance that the file contents are similar?

1

If the ssdeep value of two files are pretty close to each other, is it guaranteed that the file contents are pretty close to each other?

It is not guaranteed but it is very likely. See also the original ssdeep paper where it computes the chance of two random files having the same or similar signature. It is not zero but is close to zero.

Or is it that when ssdeep is completely dissimilar there is no chance that the file contents are similar?

This depends on what is considered similar. If one for example recodes a UTF-8 file to UTF-16 one might consider the content still similar since it is just differently encoded, but the ssdeep hash will be very different.

If one instead treats the data as octets without any specific semantics and views the similarity as the amount of insertions or deletions, then a very different ssdeep value will mean in most cases a high number of insertions or deletions.

But one can probably create some input where a small change will lead to a large ssdeep difference. This is the case where the small change would lead to a critical change in the length to the signature so that it is considered too small with the original block size in on of the inputs which will cause a recalculation with the block size halved, leading to a very different signature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.