Binary executable file similarity calculation using function matching
- Authors
- Kim, TaeGuen; Lee, Yeo Reum; Kang, BooJoong; Im, Eul Gyu
- Issue Date
- Feb-2019
- Publisher
- SPRINGER
- Keywords
- Malware analysis; Function matching; Binary file similarity
- Citation
- JOURNAL OF SUPERCOMPUTING, v.75, no.2, pp.607 - 622
- Indexed
- SCIE
SCOPUS
- Journal Title
- JOURNAL OF SUPERCOMPUTING
- Volume
- 75
- Number
- 2
- Start Page
- 607
- End Page
- 622
- URI
- https://scholarworks.bwise.kr/hanyang/handle/2021.sw.hanyang/148373
- DOI
- 10.1007/s11227-016-1941-2
- ISSN
- 0920-8542
- Abstract
- Nowadays, computer software is an essential part in our lives and is used in various fields. While software gives us convenience, it also causes many problems. Various research efforts are needed to defend against software plagiarism, attacks using malware/software, and so on. Analysis techniques of binary executable files can be applied to investigate and defend these problems. However, it is relatively hard to analyze binary executable files without source code information, because executable files only have the information for execution and discard semantic information during the compiling process. In this paper, we proposed a similarity calculation method for binary executable files, based on function matching techniques. Attributes of a function are extracted and these attributes are used to match functions of two binary files. Our function matching process is composed of three steps: the function name matching step, the N-tuple matching step, and the final n-gram-based matching step. After the function matching process is performed, the overall similarity is calculated based on similarities of matched functions. Experimental results show that similarity accuracy of our binary-based similarity calculation method is similar to those of a well-known source-code-based method, call MOSS.
- Files in This Item
-
Go to Link
- Appears in
Collections - 서울 공과대학 > 서울 컴퓨터소프트웨어학부 > 1. Journal Articles
![qrcode](https://api.qrserver.com/v1/create-qr-code/?size=55x55&data=https://scholarworks.bwise.kr/hanyang/handle/2021.sw.hanyang/148373)
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.