Full Content Search in Malware Collections

Abstract

This paper aims to provide the techniques for performing fast searches by content in large malware collections. The ability to retrieve malware samples sharing a given content is important for malware researchers that look for previous instances of a new sample or test new signatures. We propose a data structure that allows fast searches and can be continuously expanded with new samples. The performance and the scalability of our solution are proved through experiments on real-world malware.