Skip to main content

BinSlayer: Accurate Comparison of Binary Executables

Bourquin, Martial and King, Andy and Robbins, Edward (2013) BinSlayer: Accurate Comparison of Binary Executables. In: Proceedings of the 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop. POPL Principles of Programming Languages . ACM, New York, USA. ISBN 978-1-4503-1857-0. (doi:10.1145/2430553.2430557) (KAR id:37627)

Language: English
Download (259kB) Preview
Official URL


As the volume of malware inexorably rises, comparison of binary code is of increasing importance to security analysts as a method of automatically classifying new malware samples; purportedly new examples of malware are frequently a simple evolution of existing code, whose differences stem only from a need to avoid detection. This paper presents a polynomial algorithm for calculating the differences between two binaries, obtained by fusing the well-known BinDiff algorithm with the Hungarian algorithm for bi-partite graph matching. This significantly improves the matching accuracy. Additionally a meaningful metric of similarity is calculated, based on graph edit distance, from which an informed comparison of the binaries can be made. The accuracy of this method over the standard approach is demonstrated.

Item Type: Book section
DOI/Identification number: 10.1145/2430553.2430557
Subjects: Q Science > QA Mathematics (inc Computing science)
Divisions: Faculties > Sciences > School of Computing > Programming Languages and Systems Group
Depositing User: Andy King
Date Deposited: 15 Dec 2013 12:54 UTC
Last Modified: 15 Feb 2020 04:05 UTC
Resource URI: (The current URI for this page, for reference purposes)
King, Andy:
  • Depositors only (login required):


Downloads per month over past year