Combined kNN classification and hierarchical similarity hash for fast malware detection

Every day, hundreds of thousands of new malicious files are created. Existing pattern-based antivirus solutions have difficulty detecting these newmalicious files. Artificial intelligence (AI)-based malware detection has been proposed to solve the problem; however, it takes a long time. Similarity hash-based detection has also been proposed; however, it has a lowdetection rate. To solve these problems, we propose k-nearest-neighbor (kNN) classification for malware detection with a vantage-point (VP) tree using a similarity hash. Whenwe use kNNclassification, we reduce the detection time by 67%and increase the detection rate by 25%. With a VP tree using a similarity hash, we reduce the similarity-hash search time by 20%.