0

I am developing software for detecting malware based on signature, in Java. I have researched a lot for the approach to move ahead.
I found that the basic idea is to store the existing malware signatures i.e. signed hashes in a malware repository and compare the presently scanned file with the stored hash values.
I am confused about how to get the existing malware hash values to build the repository. Any help regarding the problem would be very useful to me.

  • 2
    The drawback of a hash function is that even one bit of difference in a piece of malware may result in an entirely different hash value. You may want a different type of signature. See also this answer. – S.L. Barth Mar 5 '15 at 16:09
  • Agreed, finding malware based on hashes alone is probably not a very good approach. Adding a single line of completely useless code, or even changing metadata fields like version number, would change the hash. – tlng05 Mar 5 '15 at 17:53
  • This is how virus scanners used to behave in the early 90s, a more heuristic approach is significantly more effective. – Damian Nikodem Mar 5 '15 at 23:36
1

In order to get those hashes, you need samples of the malware that you want to detect. That is one of the reasons why AV companies have very large teams to hunt for and identify malware, and why their database of hashes tends to be guarded.

For your project, you will need to find (or write) malware and collect those hashes.

  • 1
    and please don't ask where to find warehouses of malware :) – schroeder Mar 5 '15 at 17:56
  • or if one gsearches "malware binary download", one might find their answer. – sandyp Mar 5 '15 at 19:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.