Skip to main content

BinSlayer: Accurate Comparison of Binary Executables

Bourquin, Martial, King, Andy, Robbins, Ed (2013) BinSlayer: Accurate Comparison of Binary Executables. In: PPREW '13. Proceedings of the 2nd ACM SIGPLAN Program Protection and Reverse Engineering Workshop. . ACM, New York ISBN 978-1-4503-1857-0. (doi:10.1145/2430553.2430557)


As the volume of malware inexorably rises, comparison of binary code is of increasing importance to security analysts as a method of automatically classifying new malware samples; purportedly new examples of malware are frequently a simple evolution of existing code, whose differences stem only from a need to avoid detection. This paper presents a polynomial algorithm for calculating the differences between two binaries, obtained by fusing the well-known BinDiff algorithm with the Hungarian algorithm for bi-partite graph matching. This significantly improves the matching accuracy. Additionally a meaningful metric of similarity is calculated, based on graph edit distance, from which an informed comparison of the binaries can be made. The accuracy of this method over the standard approach is demonstrated.

Item Type: Conference or workshop item (Paper)
DOI/Identification number: 10.1145/2430553.2430557
Subjects: A General Works
A General Works > AC Collections. Series. Collected works
Divisions: Faculties > Sciences > School of Computing > Programming Languages and Systems Group
Depositing User: Andy King
Date Deposited: 15 Dec 2013 12:54 UTC
Last Modified: 29 May 2019 11:41 UTC
Resource URI: (The current URI for this page, for reference purposes)
  • Depositors only (login required):


Downloads per month over past year