Similarity hashing of malware on IoT devices

Abstract

A security threat to enterprise networks is the malware that exists on IoT devices which is rarely controlled at the same level that are observed for conventional computing devices. More specifically, IoT devices are poorly monitored for malware. Through self-modification, this malware attempts to hide its presence in order to evade anti-virus software. The con- sequences of this problem primarily affect the integrity of the IoT device. Availability and the confidentiality of the data are also affected. One solution for finding the malware is a similarity hash, which is a method of finding similarities between two or more data sets. This thesis compares and contrasts several similarity algorithms and gives a detailed examination of each, intending to find the best algorithm for working with self-modifying malware on IoT devices with smaller processors. The algorithms are examined from multiple points of view: the underlying equations, efficient interactions with computer architecture, and as tools for the system owners and cybersecurity analysts.