Binary Executable Similarity via Function Signatures and Locality Sensitive Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods are inefficient in identifying similar or cloned applications, as they often require extensive comparisons of binary executables, leading to resource wastage and increased complexity.
Innovation Solution
Generating locality sensitive hash values for binary executables based on function signatures, grouping similar applications, and performing function-wise comparisons within these groups to identify duplicates or clones, thereby reducing the number of comparisons needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If extensive comparisons of binary executables are performed to identify similar applications, then detection precision is improved, but productivity deteriorates due to resource wastage and increased complexity
Solution Approach 1:
The patent segments the binary executable into multiple functions and generates a separate signature for each function. This segmentation allows the system to compare individual function signatures rather than performing extensive comparisons of entire binary executables, thereby maintaining detection precision while improving productivity by reducing the computational burden.
Solution Approach 2:
The patent transforms the binary executable into a different parameter representation through function signature generation. Instead of comparing raw binary data directly, the system converts the executable into a set of function signatures that capture the essential functional characteristics, enabling efficient comparison while preserving the ability to detect similar applications.
2Productivity
If function signatures are generated and locality sensitive hash values are used to group applications, then productivity is improved by reducing comparisons needed, but device complexity increases
Solution Approach 1:
The patent introduces locality sensitive hash values as an intermediary mechanism to group applications before comparison. This intermediary step organizes applications into buckets based on their function signatures, significantly reducing the number of comparisons needed and improving productivity, while the added complexity of the hashing mechanism is offset by the substantial reduction in comparison operations.
3Measurement precision
If binary executables are compared directly to identify cloned applications, then detection precision is maintained, but loss of time increases due to extensive comparisons required
Solution Approach 1:
The patent performs preliminary actions by generating function signatures and locality sensitive hash values before the actual comparison process. This preliminary processing organizes the data in a way that enables rapid identification of potential clones, maintaining detection precision while significantly reducing the time required for the comparison operation by eliminating the need to compare all binary executables exhaustively.
Data Source
AI summary
In some implementations, a computing device can determine the similarity of binary executables. For example, the computing device can receive an application, including a binary executable. The computing device can generate function signatures for the functions called within the binary executable. The computing device can generate a locality sensitive hash value for the application based on the function signatures. The computing device can group applications based on the locality sensitive hash value generated for each application. The computing device can compare the function signatures of the binary executables of the applications within a group to determine the similarity of the applications. If two applications have binary executables that are over a threshold percentage of similarity, the two applications can be identified as clones of each other.