Hierarchical Heterogeneous Ant Colony Optimization Based Approach to Optimize File Similarity Searches Using ssDeep

Abstract

Identifying files similar to a particular file helps forensic investigators to identify malwares. The computational complexity of the existing approaches in literature for identifying similar files using ssDeep signatures is high. Brian Wallace had proposed an approach to optimize ssDeep comparisons. However, the drawback is that the substrings of the incoming chunks are checked for a match with the substrings of chunks in the reference list before an edit distance method is applied. Thus to further optimize the search space, a Hierarchical Heterogeneous Ant Colony Optimization based approach to detect similarity in ssDeep signatures (HHACOS) algorithm is proposed. The substrings of the chunks and double chunks of the incoming ssDeep message digest is compared with the substrings of the chunks and the double chunks of the ssDeep digests in the reference list. An ant agent identifies the search space and the number of substrings of the chunks and double chunks of the message digest in the reference list matching with the incoming ssDeep digest is found and the similarity between the files is computed. It is shown that HHACOS algorithm scales well compared to the existing approaches in terms of computational complexity. Also, the accuracy of detecting file similarity is efficient.