윈도우 실행파일을 위한 모듈 기반 유사도 측정 시스템

초록

This paper presents an effective system to measure and compare similarity between Microsoft Windows executable files. When a user inputs two target binary programs in the web interface, the system computes the similarity between them and shows the results. We currently implement four algorithms (modules) for measuring similarity of Windows executable files, and a user can obtain the similarity computed using each algorithm. Our system also provides an integrated similarity measure that quantifies the similarity between two files using the four algorithms at the same time. For the integrated similarity measure, a user can assign a weight for each algorithm. Since we develop each algorithm as an extensible module, it is easy to improve an algorithm or add a new one.

키워드