Enhancing Malware Code Similarity Detection through Vectorsearch and TLSH
summary
Disassembles binaries into function-sized byte sequences, computes TLSH per-function hashes (treating the TLSH hex output as a vector), and indexes them in a vector search to find code reuse; using Binary Ninja IL to normalize across x86/ARM and cross-OS builds reduces TLSH distances (example: IL-hashed functions score ~60 where <80 indicates very strong similarity). Prototype flags real overlaps (BlackMatter↔LockBit, Clop↔Ruk, Phobos↔LBit), runs against ~1M samples/week (≈200 unique functions/sample → 10.4 billion vectors for a year), works but hits RAM and TLSH-library maintenance limits.
AI-written summary · about
chapters (22)
- 0:00Introduction and concepts
- 2:30How vector search works
- 5:32Ease of use for developers
- 6:35Local sensitivity hashing
- 7:11Analyzing hash properties
- 10:30Comparison of hashing methods
- 11:48The role of disassemblers
- 12:50Combining tools for research
- 13:45Identifying code origins
- 14:21Detecting malware overlap
- 15:13Ransomware trends and analysis
- 16:05Advancements in disassembly
- 16:58Cross-platform challenges
- 18:44Solving the matching problem
- 18:58Real-world plugin benefits
- 19:16Scaling and infrastructure
- 20:26Resource constraints
- 20:40Optimizing storage pipelines
- 21:09Library maintenance issues
- 22:17Collaborative solutions
- 22:42Closing thoughts
- 22:56Future potential
related talks
30mEnhancing CTI Processes with Code Search Technology
40mDemystifying File Similarity for Malware Detection
41mfn_fuzzy: Fast Multiple Binary Diffing Triage With IDA
27mBinSim: Trace-based Semantic Binary Diffing...
16mCodeExtract: Enhancing Binary Code Similarity Detection with Code Extraction Techniques
45m"Advanced Malware Threat: handling obfuscated code using..."
36mNinja Correlation of APT Binaries
57mCode Genome - Fingerprinting Code to Build Trustworthy SBOMs