Evaluation of Image Similarity Algorithms for Malware Fake-Icon Detection
Jun-Seob Kim, Wookhyun Jung, Sangwon Kim, Shinho Lee, Eui Tak Kim · 2020
Malware Creators have steadily used Social engineering attacks that induce people to execute malware by stealing icons of well-known programs or disguise malware as normal programs. Therefore, a method of comparing the similarity of icons has been proposed to detect this type of malware. To compare similarity, methods of icon hash comparison, machine learning, or image similarity have been used. Among them, the image similarity hash algorithm for image similarity comparison has been used for the purpose of detecting icons used by malware since it allowed us to search for a similar image just by a simple calculation. However, It is required to inspect not only malware having identical image similarity hash value but also a wider range of malware using a similar icon to respond to malware that uses icons to deceive people. In this paper, we verify the search performance of the image similarity hash algorithm based on icon information extracted from real malware and present the performance index of the image similarity hash algorithm.