Accurate Comparison of Binary Executables
Martial Bourquin, Andy King, Edward Robbins · 2013
As the volume of malware inexorably rises, comparison of binary code is of increasing importance to security analysts as a method of automatically classifying new malware samples; purportedly new examples of malware are frequently a simple evolution of exist-ing code, whose differences stem only from a need to avoid de-tection. This paper presents a polynomial algorithm for calculat-ing the differences between two binaries, obtained by fusing the well-known BinDiff algorithm with the Hungarian algorithm for bi-partite graph matching. This significantly improves the matching accuracy. Additionally a meaningful metric of similarity is calcu-lated, based on graph edit distance, from which an informed com-parison of the binaries can be made. The accuracy of this method over the standard approach is demonstrated. 1.