二进制文件相似性检测技术对比分析  

Comparison and analysis on binary file similarity detection technique

作　　者：陈慧[1,2] 郭涛[3] 崔宝江[2] 王建新[4] 

机构地区：[1]山东英才学院计算机学院,济南250104 [2]北京邮电大学计算机学院,北京100876 [3]中国信息安全测评中心,北京100085 [4]北京林业大学信息学院,北京100083

出　　处：《计算机工程与应用》2012年第33期79-84,共6页Computer Engineering and Applications

基　　金：国家自然科学基金(No.61170268;No.90818021)

摘　　要：传统的文件相似性检测技术是基于源代码的,针对源代码难以获取的情况,二进制文件比对技术被提出并受到越来越多的关注。总结和分析了四种二进制文件相似性检测技术和主流的检测工具。在提出了二进制文件克隆比对的评价方法的基础上进行了实验测试。该方法针对二进制文件克隆的分类方式,设计了实验流程和相似度的计算标准。结果表明对于连续克隆,不影响调用关系的分割克隆,不影响基本块数量和调用关系的等价替换克隆,采用二进制文件相似性检测比采用基于token的源代码文件相似性检测能得到更准确的检测结果。The traditional file similarity detection technique is generally based on source code.In the case of source code unavailable,binary comparison technique is proposed for clone detection.Four binary file similarity detection techniques and the main detection tools are summarized and analyzed.Based on the evaluation method of binary file clone comparison,the experiment test has been carried on.This method provides a review of binary file clone types,detection approaches and the similarity calculation standard.Experiments show that for continuous clone,division clone which doesn＇t affect the call relations,equivalent replacement clone which doesn＇t affect basic block number and the call relations,the techniques similarity detection with the binary files gets more accurate result than the ones token-based similarity detection with the source code files.

关 键 词：软件同源性 二进制文件比对 克隆检测 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]