基于函数调用图的二进制程序相似性分析

计算机工程与应用 ›› 2016, Vol. 52 ›› Issue (21): 126-133.

基于函数调用图的二进制程序相似性分析

孙贺1，吴礼发1，洪征1，徐明飞2，周胜利1，3

1.解放军理工大学指挥信息系统学院，南京 210007
2.中国人民解放军73680部队
3.浙江警察学院计算机与信息技术系，杭州 310000

出版日期:2016-11-01 发布日期:2016-11-17

Research on function call graph based method for similarity analysis of binary files

SUN He1, WU Lifa1, HONG Zheng1, XU Mingfei2, ZHOU Shengli1，3

1.Institute of Command Information System, PLA University of Science and Technology, Nanjing 210007, China
2.Unit 73680 of PLA, China
3.Department of Computer and Information Technology, Zhejiang Police College, Hangzhou 310000, China

Online:2016-11-01 Published:2016-11-17

摘要/Abstract

摘要： The existing methods of analyzing similarities of binary files based on function call graphs are generally ineffective when dealing with obfuscated programs. A novel analytic hierarchy method based on sub-graph matching is proposed to handle the problems. The proposed method regards sub-graph as the minimal testing unit and tests the similarity of binary files through three steps. The method uses the weighted average strategy to calculate the similarity according to the similarity of each sub-graph. The test results show that the method is more stable with sound similarity results and more efficient compared with the existing methods.

关键词: static analysis, function call graph, similarity analysis, analytic hierarchy method

Abstract: The existing methods of analyzing similarities of binary files based on function call graphs are generally ineffective when dealing with obfuscated programs. A novel analytic hierarchy method based on sub-graph matching is proposed to handle the problems. The proposed method regards sub-graph as the minimal testing unit and tests the similarity of binary files through three steps. The method uses the weighted average strategy to calculate the similarity according to the similarity of each sub-graph. The test results show that the method is more stable with sound similarity results and more efficient compared with the existing methods.

Key words: static analysis, function call graph, similarity analysis, analytic hierarchy method

孙贺1，吴礼发1，洪征1，徐明飞2，周胜利1，3. 基于函数调用图的二进制程序相似性分析[J]. 计算机工程与应用, 2016, 52(21): 126-133.

SUN He1, WU Lifa1, HONG Zheng1, XU Mingfei2, ZHOU Shengli1，3. Research on function call graph based method for similarity analysis of binary files[J]. Computer Engineering and Applications, 2016, 52(21): 126-133.