No ML, Just Hashes: Code Similarity Distance for Detecting IoT Malware

The steady rise of consumer Internet-of-Things (IoT) device usage has proportionally led to an increase in malware targeting embedded systems. Exact hash matching using MD5 or SHA-256 for malware detection is ineffective when small changes alter file hashes. In this paper, we present a lightweight approach based on similarity hashing for detecting Extensible and Linkable Format (ELF) IoT malware binaries. Eighteen datasets, each containing 1,284 malicious and 1,291 clean ELF samples, were collected for analysis. For every sample, three similarity hashes namely SSDEEP, Trend Micro Locality Sensitive Hash (TLSH), and Lempel-Ziv Jaccard Distance (LZJD) were computed under two hashing views. A static-feature view hashes extracted metadata and printable strings, while a file-structure view removes ELF headers and hashes only the executable payload. Using fixed thresholds, the approach avoids machine learning pipelines entirely. On a held-out validation set, SSDEEP (static view) achieved the best overall performance with an accuracy of 78.3% and precision of 0.84, while LZJD (payload view) maintained the highest precision of 0.93 across thresholds, demonstrating its strength in detecting content-level similarities among ELF malware samples. In terms of resource usage, memory profiling revealed that SSDEEP required around 2.4 KB per hash comparison, whereas TLSH and LZJD consumed approximately 0.27 KB on average, confirming the efficiency of their fixed-length hash representations. The proposed pipeline is computationally lightweight as it relies on single-pass hashing, compact hash comparisons, and minimal memory overhead, making it suitable for real-time malware detection in IoT gateways and edge devices.