0

I am developing software for detecting malware based on signature, in Java. I have researched a lot for the approach to move ahead.
I found that the basic idea is to store the existing malware signatures i.e. signed hashes in a malware repository and compare the presently scanned file with the stored hash values.
I am confused about how to get the existing malware hash values to build the repository. Any help regarding the problem would be very useful to me.

3
  • 2
    The drawback of a hash function is that even one bit of difference in a piece of malware may result in an entirely different hash value. You may want a different type of signature. See also this answer. Commented Mar 5, 2015 at 16:09
  • Agreed, finding malware based on hashes alone is probably not a very good approach. Adding a single line of completely useless code, or even changing metadata fields like version number, would change the hash.
    – tlng05
    Commented Mar 5, 2015 at 17:53
  • This is how virus scanners used to behave in the early 90s, a more heuristic approach is significantly more effective. Commented Mar 5, 2015 at 23:36

1 Answer 1

1

In order to get those hashes, you need samples of the malware that you want to detect. That is one of the reasons why AV companies have very large teams to hunt for and identify malware, and why their database of hashes tends to be guarded.

For your project, you will need to find (or write) malware and collect those hashes.

2
  • 1
    and please don't ask where to find warehouses of malware :)
    – schroeder
    Commented Mar 5, 2015 at 17:56
  • or if one gsearches "malware binary download", one might find their answer.
    – sandyp
    Commented Mar 5, 2015 at 19:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .