148 0

Binary executable file similarity calculation using function matching

Title
Binary executable file similarity calculation using function matching
Author
임을규
Keywords
Malware analysis; Function matching; Binary file similarity
Issue Date
2019-02
Publisher
SPRINGER
Citation
JOURNAL OF SUPERCOMPUTING, v. 75, Issue 2, Page. 607-622
Abstract
Nowadays, computer software is an essential part in our lives and is used in various fields. While software gives us convenience, it also causes many problems. Various research efforts are needed to defend against software plagiarism, attacks using malware/software, and so on. Analysis techniques of binary executable files can be applied to investigate and defend these problems. However, it is relatively hard to analyze binary executable files without source code information, because executable files only have the information for execution and discard semantic information during the compiling process. In this paper, we proposed a similarity calculation method for binary executable files, based on function matching techniques. Attributes of a function are extracted and these attributes are used to match functions of two binary files. Our function matching process is composed of three steps: the function name matching step, the N-tuple matching step, and the final n-gram-based matching step. After the function matching process is performed, the overall similarity is calculated based on similarities of matched functions. Experimental results show that similarity accuracy of our binary-based similarity calculation method is similar to those of a well-known source-code-based method, call MOSS.
URI
https://link.springer.com/article/10.1007%2Fs11227-016-1941-2https://repository.hanyang.ac.kr/handle/20.500.11754/103431
ISSN
0920-8542; 1573-0484
DOI
10.1007/s11227-016-1941-2
Appears in Collections:
COLLEGE OF ENGINEERING[S](공과대학) > COMPUTER SCIENCE(컴퓨터소프트웨어학부) > Articles
Files in This Item:
There are no files associated with this item.
Export
RIS (EndNote)
XLS (Excel)
XML


qrcode

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.

BROWSE