A method and system for identifying homologous binary files

Abstract

The invention provides a method and a system for identifying homologous binary files in a database. The database comprises multiple binary basic files. The method comprises the steps of obtaining signatures of to-be-identified files and signatures of the basic files according to a min-hash algorithm; for any signature, performing bucket dividing processing on the signature according to a bucket dividing method; according to a reverse indexing method and the signatures, subjected to bucket dividing, of all the basic files, obtaining dictionaries in one-to-one correspondence with buckets, wherein each dictionary comprises at least one key value pair; according to character strings in the buckets of the to-be-identified files, traversing the corresponding dictionaries, and according to valuescorresponding to matching keys, obtaining the homologous binary files of the to-be-identified files. According to the method and the system, the signatures are obtained by adopting the min-hash algorithm and the bucket dividing is performed by adopting a local sensitive hash algorithm, so that the calculation amount can be remarkably reduced; and by adopting the reverse indexing method, an indextable is established for all the signatures, so that the speed of identifying the homologous binary files is increased.

Description

technical field [0001] The present invention relates to the technical field of vulnerability mining for embedded devices, and more specifically, to a method and system for identifying homologous binary files. Background technique [0002] In recent years, IoT devices have been connected to the network at a nearly doubled speed, which greatly facilitates people's lives. However, these smart devices face the risk of being attacked due to the lack of security awareness of the manufacturers and the extensive use of shared code modules and third-party SDKs. [0003] For example, on October 21, 2016, hackers used network cameras and other equipment to attack DNS provider Dyn in a distributed denial-of-service attack (DDoS), destroying a series of large Internet websites, including Spotify, Twitter, PayPal, Netflix, etc. The media called this attack "the worst DDos attack in history", and the security of IoT devices received more attention. When an emergency security event occurs...

AI Technical Summary

Problems solved by technology

However, this method lacks the understanding of program logic and is only suitable for the retrieval of small files

Images