Similarity hashing of malware on IoT devices

A security threat to enterprise networks is the malware that exists on IoT devices which is rarely controlled at the same level that are observed for conventional computing devices. More specifically, IoT devices are poorly monitored for malware. Through self-modification, this malware attempts to hide its presence in order to evade anti-virus software. The con- sequences of this problem primarily affect the integrity of the IoT device. Availability and the confidentiality of the data are also affected. One solution for finding the malware is a similarity hash, which is a method of finding similarities between two or more data sets. This thesis compares and contrasts several similarity algorithms and gives a detailed examination of each, intending to find the best algorithm for working with self-modifying malware on IoT devices with smaller processors. The algorithms are examined from multiple points of view: the underlying equations, efficient interactions with computer architecture, and as tools for the system owners and cybersecurity analysts.

Name thesis:degree_name

Master of Science (M.S.)

Level thesis:degree_level

Masters

Discipline thesis:degree_discipline

Computer Science

Grantor dc:publisher

Colorado School of Mines. Arthur Lakes Library

Year dc:date.issued

2019

Author dc:creator

• Hughes, Michael B.

Advisor dc:contributor.advisor

• Yue, Chuan

Committee members dc:contributor.committeemember

• Wu, Bo
• Romig, Phillip Richardson

• IoT
• similarity
• malware
• hash

Statement dc:rights

• Copyright of the original work is retained by the author.

Language dc:language.iso

eng, English

Identifier

T 8732

OAI identifier oai:identifier

oai:repository.mines.edu:11124/173074