Ssdeep fuzzysearch

[kh4rdur]

Feature Category

• Correctness
• User Interface / User Experience
• Performance
• Other (please explain)

Describe the problem

At this moment, clicking or searching for a ssdeep hash, you only get samples with that specific hash gets returned.

Describe the solution you'd like

The fuzzy hashing method ssdeep is created to find more samples that are alike in a way. I would like to see it is all possibility (api and ui) to fuzzy search with ssdeep hashes, to find samples that could be from the same family.

Describe alternatives you've considered

There a possibility to use asterisks in the hashes, but this goes against how ssdeep works.

[psrok1]

Yes, currently these ssdeep hashes doesn't have much sense and I was thinking about removing them completely or making them optional.

MWDB is driven by PostgreSQL and I'm not aware of any good fuzzy search mechanism that would apply to ssdeep/tlsh hashes. If I'm wrong and you have any idea how we can implement that, let me know!

[kh4rdur]

Would be a great option to have actually. Getting insights in the ssdeep (or tlsh hashes) and finding Similar samples is a big addition for us to use mwdb.

I haven't tested it myself, but looking at the postgres website, there is a fuzzystrmatch module available.
https://www.postgresql.org/docs/current/fuzzystrmatch.html

Based on this article (https://medium.com/@petergleeson1/how-to-use-fuzzy-string-matching-in-postgresql-2daa4a0760c6) It looks like the Levenshtein solution could be an interesting one, having an option to calculate the number of differences in the string.
What is your view on this?

[kh4rdur]

When searching for SSdeep and Postgresql , i've noticed a project https://github.com/malwaredb/malwaredb-rs/tree/main.
It seems like within this project they got a way of using SSDeep searches and TLSH searches within PSQL..
maybe this can be teh solution for this ?

https://github.com/malwaredb/ssdeep_psql
https://github.com/malwaredb/tlsh_pg