# Comparative Analysis of Hash-based Malware Clustering via K-Means

arXiv: https://arxiv.org/abs/2512.09539 · HTML: https://mlsanity.com/paper/2512.09539/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 29 references that are in the map.
- First posted on arXiv 10 Dec 2025.

## Builds on (most cited first, 1 of 1)

- [Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning](https://mlsanity.com/paper/2205.12569/) (2022)

## Built on by (most cited first, 1 of 1)

- [A Unified Evaluation of Learning-Based Similarity Techniques for Malware Detection](https://mlsanity.com/paper/2602.15376/) (2026)

## Abstract (arXiv)

With the adoption of multiple digital devices in everyday life, the cyber-attack surface has increased. Adversaries are continuously exploring new avenues to exploit them and deploy malware. On the other hand, detection approaches typically employ hashing-based algorithms such as SSDeep, TLSH, and IMPHash to capture structural and behavioural similarities among binaries. This work focuses on the analysis and evaluation of these techniques for clustering malware samples using the K-means algorithm. More specifically, we experimented with established malware families and traits and found that TLSH and IMPHash produce more distinct, semantically meaningful clusters, whereas SSDeep is more efficient for broader classification tasks. The findings of this work can guide the development of more robust threat-detection mechanisms and adaptive security mechanisms.