Fuzzy Hashing and Locality-Sensitive Hashing for File Analysis
Learn about bro-fuzzy-hashing and its applications in file analysis, including fuzzy hashing and locality-sensitive hashing. Explore examples, use cases, and open questions related to these advanced hashing techniques.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
bro-fuzzy-hashing Jan Grash fer (KIT)
Fuzzy Hashing aka Locality-Sensitive Hashing E74bccc6a838c4faf8454a3f4bdea76b2507d45c SHA1 Hash: 53686f67b0f242745ea56708f2623919f9ebda19 6144:8cM3jdzP9GwzZZfeTxKbb7UD31YrO2o9mK9uVKCM+kZIP:8cIjew1lcdYy2oUGCM+MS Fuzzy Hash: 6144:8cM3jdzP9GwzZZfeTxKbbOUD31YrO2o9mK9uVKCM+kZIP:8cIjew1lcQYy2oUGCM+MS
bro-fuzzy-hashing Example event file_sniff(f: fa_file, meta: fa_metadata) { Files::add_analyzer(f, Files::ANALYZER_SHA1); Files::add_analyzer(f, Files::ANALYZER_TLSH); } Requirements: TLSH library ssdeep library (libfuzzy) event file_hash(f: fa_file, kind: string, hash: string) { print fmt("file_hash: %s", hash); } Provides same functionality as Bro s built-in hashing: File Analyzer Opaque type event file_fuzzy_hash(f: fa_file, kind: string, hash: string) { print fmt("file_fuzzy_hash: %s", hash); } github.com/J-Gras/bro-fuzzy-hashing available as Bro package jan.grashoefer@kit.edu
bro-fuzzy-hashing Example event file_sniff(f: fa_file, meta: fa_metadata) { Files::add_analyzer(f, Files::ANALYZER_SHA1); Files::add_analyzer(f, Files::ANALYZER_TLSH); } Use cases: Approximate file matching Incomplete files \_( )_/ event file_hash(f: fa_file, kind: string, hash: string) { print fmt("file_hash: %s", hash); } Open questions: Practicability Performance event file_fuzzy_hash(f: fa_file, kind: string, hash: string) { print fmt("file_fuzzy_hash: %s", hash); } github.com/J-Gras/bro-fuzzy-hashing jan.grashoefer@kit.edu
