# Lempel-Ziv Jaccard Distance, an Effective Alternative to Ssdeep and Sdhash

arXiv: https://arxiv.org/abs/1708.03346 · HTML: https://mlsanity.com/paper/1708.03346/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Aug 2017.

## Built on by (most cited first, 8 of 8)

- [Efficient Malware Analysis Using Metric Embeddings](https://mlsanity.com/paper/2212.02663/) (2022)
- [Holographic Global Convolutional Networks for Long-Range Prediction Tasks in Malware Detection](https://mlsanity.com/paper/2403.17978/) (2024)
- [Lempel-Ziv Networks](https://mlsanity.com/paper/2211.13250/) (2022)
- [Neural Normalized Compression Distance and the Disconnect Between Compression and Classification](https://mlsanity.com/paper/2410.15280/) (2024)
- [Carbon Filter: Real-time Alert Triage Using Large Scale Clustering and Fast Search](https://mlsanity.com/paper/2405.04691/) (2024)
- [Combining AI and AM - Improving Approximate Matching through Transformer Networks](https://mlsanity.com/paper/2208.11367/) (2022)
- [Hamm-Grams: An Algorithm for Mining Regular Expressions of Bytes](https://mlsanity.com/paper/2607.01445/) (2026)
- [Fast And Accurate Text Content File Type Identification](https://mlsanity.com/paper/2609.21306/) (2026)

## Abstract (arXiv)

Recent work has proposed the Lempel-Ziv Jaccard Distance (LZJD) as a method to measure the similarity between binary byte sequences for malware classification. We propose and test LZJD's effectiveness as a similarity digest hash for digital forensics. To do so we develop a high performance Java implementation with the same command-line arguments as sdhash, making it easy to integrate into existing workflows. Our testing shows that LZJD is effective for this task, and significantly outperforms sdhash and ssdeep in its ability to match related file fragments and files corrupted with random noise. In addition, LZJD is up to 60x faster than sdhash at comparison time.