关键词: 二进制文件, 同源性检测, 结构化签名, 权重

Abstract:

A method of similarity computation for executable objects homology detection based on structural signature was proposed. At first step, considering the characteristic of clone code, a signature of basic code block was designed. On the basis of the hierarchical structure of filefunctionbasic code block, similarity measurement of basic code block was built based on its basic properties and structural information. At second step, to evaluate the homology between original and object files, the similarity was calculated through constructing function weight by means of function structural information. Aiming at the most common clone patterns, some experiments were conducted between the proposed method, the method without considering weight and some mainstream similarity detection tools. Comparative results demonstrate that the proposed method can measure the similarity of two executable objects more accurately than other methods.

Key words: executable objects, homologous detection, structural signature, weight