Hash code-based search apparatus and search method

1. A hash code-based search apparatus comprising:

a token set extracting unit configured to extract a token set having at least one token from a document;

a hash code generating unit configured to generate N hash codes by applying N hash functions to the at least one token, N being a natural number; and

an index generating unit configured to generate a search index by indexing the document with the N hash codes,

wherein the hash code generating unit is further configured to

determine the N hash functions and generate one hash code by applying one of the N hash functions to the at least one token, and

select the N hash functions from a population of hash functions based on a size of a hash code output from each of the hash functions and a type of the document, and

wherein the token set extracting unit, the hash code generating unit, and the index generating unit are each implemented via at least one processor.

2. The hash code-based search apparatus of claim 1 , wherein the token set extracting unit is further configured to generate the at least one token by performing an N-gram-based shingling operation on the document.

3. The hash code-based search apparatus of claim 1 , wherein the token set extracting unit is further configured to generate the at least one token by performing an N-gram-based shingling operation on the document and add a numeric value after any duplicated token.

4. The hash code-based search apparatus of claim 1 , wherein the token set extracting unit is further configured to generate the at least one token by performing an N-gram-based shingling operation on the document and remove any duplicated token.

5. The hash code-based search apparatus of claim 1 , wherein the hash code generating unit is further configured to configure each of the N hash functions as a MinHash function so that each of the N hash functions receives the at least one token and a minimum value having a smallest value is determined as the hash code.

6. The hash code-based search apparatus of claim 1 , wherein the index generating unit is further configured to configure the N hash codes as an index set of a fixed size, reducing an index storage capacity of the document.

7. The hash code-based search apparatus of claim 1 , further comprising:

a document search unit configured to receive a search term and search for the document based on a similarity between the search term and the search index,

wherein the document search unit is implemented via at least one processor.

8. The hash code-based search apparatus of claim 1 , wherein the hash code-based search apparatus receives the document as a malware and generates the search index as an index for the malware.

9. The hash code-based search apparatus of claim 1 , wherein when the document corresponds to a text file, the hash code generating unit is further configured to select a first hash function from the population of hash functions that outputs a hash code having a first size, and

when the document corresponds to a binary file, the hash code generating unit is further configured to select a second hash function from the population of hash functions that outputs a hash code having a second size smaller than the first size.

10. A hash code-based search method comprising:

extracting a token set having at least one token from a document;

generating N hash codes by applying each of N hash functions to the at least one token, N being a natural number;

generating a search index by indexing the document with the N hash codes;

determining the N hash functions and generate one hash code by applying one of the N hash functions to the at least one token; and

selecting the N hash functions from a population of hash functions based on a size of a hash code output from each of the hash functions and a type of the document.

11. A non-transitory computer-readable medium having embodied thereon a program, which when executed by a computer causes the computer to execute a hash code-based search method, the method comprising:

extracting a token set having at least one token from a document;

generating N hash codes by applying each of N hash functions to the at least one token, N being a natural number;

generating a search index by indexing the document with the N hash codes;

determining the N hash functions and generate one hash code by applying one of the N hash functions to the at least one token; and

selecting the N hash functions from a population of hash functions based on a size of a hash code output from each of the hash functions and a type of the document.