Abstract: The existing methods of analyzing similarities of binary files based on function call graphs are generally ineffective when dealing with obfuscated programs. A novel analytic hierarchy method based on sub-graph matching is proposed to handle the problems. The proposed method regards sub-graph as the minimal testing unit and tests the similarity of binary files through three steps. The method uses the weighted average strategy to calculate the similarity according to the similarity of each sub-graph. The test results show that the method is more stable with sound similarity results and more efficient compared with the existing methods.

Key words: static analysis, function call graph, similarity analysis, analytic hierarchy method

摘要： The existing methods of analyzing similarities of binary files based on function call graphs are generally ineffective when dealing with obfuscated programs. A novel analytic hierarchy method based on sub-graph matching is proposed to handle the problems. The proposed method regards sub-graph as the minimal testing unit and tests the similarity of binary files through three steps. The method uses the weighted average strategy to calculate the similarity according to the similarity of each sub-graph. The test results show that the method is more stable with sound similarity results and more efficient compared with the existing methods.

关键词: static analysis, function call graph, similarity analysis, analytic hierarchy method