Table 5 Comparison of similarity detection results of enhanced YARA rules with SSDEEP, SDHASH, mvHASH-B, IMPHASH and YARA rules
Ransomware category | SSDEEP fuzzy hashing detection rate (%) | SDHASH fuzzy hashing detection rate (%) | mvHASH-B fuzzy hashing detection rate (%) | IMPHASH import hashing detection rate (%) | YARA rules detection rate (%) | Enhanced YARA rules detection rate (%) |
|---|---|---|---|---|---|---|
WannaCry ransomware | 90.8 | 90 | 84.4 | 87.6 | 89.6 | 93.2 |
Locky ransomware | 41.6 | 30.4 | 33.6 | 31.6 | 54.4 | 59.6 |
Cerber ransomware | 33.6 | 28.4 | 36 | 61.6 | 77.2 | 77.2 |
CryptoWall ransomware | 28 | 20.4 | 20.4 | 27.2 | 27.6 | 38.4 |