基于划分的二进制文件相似性比较方法

Partition-based binary file similarity comparison method

针对传统文件结构化相似性比较法中采用基本块(BB)一对一映射而造成的巨大时空消耗及基本块比较结果的绝对化问题,提出一种基于划分思想的文件结构化相似性比较方法。该方法首先对用于基本块比较的小素数积法进行改进,通过改进方法将函数内的基本块进行分类,再结合基本块签名与属性的权重求得基本块间的相似率,从而计算出最终的函数相似率及文件相似率。通过函数相似率比较实验分析,与未考虑划分思想的绝对化基本块比较算法相比,该方法在比较效率及准确率上均有所提升。实验结果表明,该方法在减少比较时间的同时提高了比较准确率,在实际二进制文件相似性比较的应用中更可行。

Focusing on the huge consumption of time and space and the absolute comparison result of Basic Block （BB） resulted from one-to-one mapping of basic block in traditional file structural similarity detection technique, a method based on dividing thought was proposed to accomplish structural comparison of binary file. Firstly, the small primes algorithm which is used to compare the basic block was improved to classify the basic blocks in a function, then the similar rates of basic blocks were obtained by combining with the weights of basic block signature and attribute, so as to get the final function similar rate and final file similar rate. In the comparison with the absolute comparison method which does not consider the partition at the similar rates of function, this proposed method has certain advantages in efficiency and accuracy. The experimental show that the proposed method improves the accuracy of comparison, and reduces the comparison time, it is more feasible in similarity comparison of binary files.