Clustering android ransomware families using fuzzy hashing similarities

Article type: Research Article

Authors: Rodriguez-Bazan, Horacio | Sidorov, Grigory | Escamilla-Ambrosio, Ponciano Jorge^{; *}

Affiliations: Centro de Investigación en Computación (CIC), Instituto Politécnico Nacional (IPN), Av. Juan de Dios Batiz, s/n, Mexico City, Mexico

Correspondence: [*] Corresponding author. Ponciano Jorge Escamilla-Ambrosio. E-mail:[email protected].

Abstract:  Recently, Android device usage has increased significantly, and malicious applications for the Android ecosystem have also increased. Security researchers have studied Android malware analysis as an emerging issue. The proposed methods employ a combination of static, dynamic, or hybrid analysis along with Machine Learning (ML) algorithms to detect and classify malware into families. These families often exhibit shared similarities among their members or with other families. This paper presents a new method that combines Fuzzy Hashing and Natural Language Processing (NLP) techniques to find Android malware families based on their similarities by applying reverse engineering to extract the features and compute fuzzy hashing of the preprocessed code. This relationship allows us to identify the families according to their features. A study was conducted using a database test of 2,288 samples from diverse ransomware families. An accuracy in classifying Android ransomware malware up to 98.46% was achieved.

Keywords: Android malware analysis, android ransomware, cybersecurity, fuzzy hashing, natural language processing

DOI: 10.3233/JIFS-219367

Journal: Journal of Intelligent & Fuzzy Systems, vol. Pre-press, no. Pre-press, pp. 1-14, 2024