908712 - Identify likely malware DLLs through statistical analysis

Status: RESOLVED INCOMPLETE

(Webtools Graveyard :: Dragnet, defect)

Description

[Brandon Savage [:brandon]]

One of the problems that we have with malware is that it offers sufficiently random names that we can't say "X file is malware, remove it."

However, assuming that the files are identical (just that the names are different), the debug ID and MD5 hash should also be identical across multiple, differently named files.

It should therefore be possible, with these two bits of data, to identify likely malware components by counting how many differently named files have the same MD5. We can come up with a threshold, and tag likely malware as such.

We can then use this information in a variety of good ways, like in FHR and the Magic 8 Ball.

Comment 1

[Takanori MATSUURA]

This bug lies at rest in the graveyard.