Identifying Malicious Source Code Using LZJD

Abstract

This work presents a proof-of-concept of the use of Lempel-Ziv Jaccard Distance, or LZJD, as a means of detecting malicious source code by comparing the suspect source code to a library of known malicious source code. In this paper we detail our method of making these comparisons, evaluate how well it works, and suggest some potential methods of improvement for future work. We conclude that LZJD does appear to be effective at identifying similar files, but that it appears to struggle when attempting to aggregate the scores to compare entire source code projects.