基于函数调用图的二进制程序相似性分析  

Research on function call graph based method for similarity analysis of binary files

作　　者：孙贺[1] 吴礼发[1] 洪征[1] 徐明飞[2] 周胜利[1,3] SUN He;WU Lifa;HONG Zheng;XU Mingfei;ZHOU Shengli(Institute of Command Information System, PLA University of Science and Technology, Nanjing 210007, China;Unit 73680 of PLA, China;Department of Computer and Information Technology, Zhejiang Police College, Hangzhou 310000, China)

机构地区：[1]解放军理工大学指挥信息系统学院 [2]中国人民解放军73680部队 [3]浙江警察学院计算机与信息技术系

出　　处：《计算机工程与应用》2016年第21期126-133,共8页Computer Engineering and Applications

基　　金：江苏省自然科学基金(No.BK2011115)

摘　　要：现有基于函数调用图的程序二进制文件相似性分析方法在分析经混淆处理的复杂程序时存在准确度低的问题。针对该问题提出了一种基于子图匹配的层次分析方法。以子图为最小检测单元,分层检测各个子图的相似度;再依据各个子图的相似度,采用加权平均策略计算程序二进制文件的相似度。实验结果表明,该方法抗干扰能力强,能够有效应用于恶意程序家族分类及新病毒变种检测,且具有较高的检测效率。The existing methods of analyzing similarities of binary files based on function call graphs are generally ineffective when dealing with obfuscated programs. A novel analytic hierarchy method based on sub-graph matching is proposed to handle the problems. The proposed method regards sub-graph as the minimal testing unit and tests the similarity of binary files through three steps. The method uses the weighted average strategy to calculate the similarity according to the similarity of each sub-graph. The test results show that the method is more stable with sound similarity results and more efficient compared with the existing methods.

关 键 词：静态分析 函数调用图 相似性分析 层次分析 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]