Software similarity measurement method and device

Abstract

The invention relates to a software similarity measurement method and device. The method comprises the following steps: acquiring an intermediate code through disassembly for a binary program, and carrying out the normalization and standardization on the intermediate code; counting semantic features of functions, screening first M similarity functions through coarse-grained similarity calculation,and adding the first M similarity functions to a candidate function set; conducting backward slicing on the functions in the candidate function set through data flow dependence and program control flow, and acquiring a constraint derivation formula set used for representing key semantics of the functions; acquiring a final similarity score of the target function and the comparison function by comparing the constraint derivation formula set; and according to the similarity score, selecting the first N functions as expert verification analysis contents. According to the method, differences of programs under different system architectures, operating systems, compilers and optimization options are reduced by preprocessing codes, patch upgrading functions similar to vulnerability function semantics are screened out through extraction and comparison of a function constraint derivation formula, and accuracy is improved.

Description

technical field [0001] The invention belongs to the technical field of computer security, in particular to a method and device for measuring software similarity. Background technique [0002] Software similarity analysis is generally given an unknown software to determine whether its functions or code fragments have homology with known software or function libraries, which can be used for software vulnerability mining, software infringement, malicious code family analysis, etc. In the field of software vulnerability mining, usually given a known vulnerability, similarity measurement method is used to find dangerous functions similar to or associated with it in large-scale software, and the risk of software being attacked can be effectively reduced by analyzing it. Software similarity analysis is divided into static analysis and dynamic analysis. Static analysis usually refers to establishing a similarity matching model by analyzing the syntax and semantics of the target pro...

AI Technical Summary

Problems solved by technology

However, even for the same source software, different binary codes will be generated under different system architectures, compilers and optimization options, and there will inevitably be corresponding errors in the feature statistics of the software decompiled code directly; secondly, when using the similarity method for vulnerability mining , there is a situation where it is impossible to effectively distinguish between vulnerable functions and patched functions, because some vulnerable functions only perform dangerous function replacement or modify constraints to avoid the triggering conditions of the vulnerability when patching, which makes it difficult to identify them using ordinary similarity measurement methods. effective distinction

Due to the above reasons, the current similarity measurement methods generally have a high false positive rate.

Images