3 ms·

I always wondered if AV databases were just minhashing/lsh on binaries... guess not!

• loeg 8y ago
  Hah, no. AV databases are just real dumb tries of whole-file MD5s, or a similar level of sophistication (i.e., not very). Usually combined with an unnecessarily privileged and unsandboxed parser for arbitrary weird file formats.
  • a-dub 8y ago
    Looking for vulny binary code in terms of jaccard similarity is interesting.
  • landr0id 8y ago
    ssdeep is also used https://www.forensicswiki.org/wiki/Ssdeep https://www.forensicswiki.org/wiki/Ssdeep