BinSlayer: Accurate Comparison of Binary Executables

Bourquin, Martial and King, Andy and Robbins, Ed (2013) BinSlayer: Accurate Comparison of Binary Executables. In: 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop, January 26, 2013, Rome, Italy. (doi:https://doi.org/10.1145/2430553.2430557) (Full text available)

Abstract

As the volume of malware inexorably rises, comparison of binary code is of increasing importance to security analysts as a method of automatically classifying new malware samples; purportedly new examples of malware are frequently a simple evolution of existing code, whose differences stem only from a need to avoid detection. This paper presents a polynomial algorithm for calculating the differences between two binaries, obtained by fusing the well-known BinDiff algorithm with the Hungarian algorithm for bi-partite graph matching. This significantly improves the matching accuracy. Additionally a meaningful metric of similarity is calculated, based on graph edit distance, from which an informed comparison of the binaries can be made. The accuracy of this method over the standard approach is demonstrated.

Item Type: Conference or workshop item (Paper)
Subjects: A General Works
A General Works > AC Collections. Series. Collected works
Divisions: Faculties > Sciences > School of Computing > Programming Languages and Systems Group
Depositing User: Andy King
Date Deposited: 15 Dec 2013 12:54 UTC
Last Modified: 03 Jul 2014 12:34 UTC
Resource URI: https://kar.kent.ac.uk/id/eprint/37627 (The current URI for this page, for reference purposes)
  • Depositors only (login required):

Downloads

Downloads per month over past year