5

I have a collection of different binaries I want to review for code similarity and classification, but I would rather not have to open each of them in IDA and manually review the code in 15 different samples.

What tools or techniques can I use to automatically classify and determine code similarity/reuse between samples? My first thought is to use ssdeep, but I was wondering if there were any other open source tools or frameworks that could do the same.

I would also like to request that a classification tag be added in case there are other people who want to ask questions about classifying files into different groups based on different binary features.

Improve this question
6
  • I am not sure if there is a general answer to your question. I would assume that this depends on how different the binaries are. Do you just want to compare different versions of normal binaries or are they randomly re-ordered, obfuscated or may be even protected with encrypted parts that decrypt at run-time?
    – Robert
    Feb 22, 2020 at 15:48
  • These are collections of malware, intended to be of the same family, but I don't know anything about their internals. There are known to be different variants based on small behaviors. I am looking to examine the code that is common to all samples to write yara rules as my use case.
    – solumnant
    Feb 24, 2020 at 16:42
  • I would like to have a framework to apply to any such group of samples I receive, since that's how I spend a lot of my time.
    – solumnant
    Feb 24, 2020 at 16:43
  • Look up "Tracelet Based Code Search".
    – user34310
    Sep 4, 2020 at 20:00
  • 1
    @user34310 feel free to write up a proper answer. I converted your "answer" to a comment as it was mere commentary. I appreciate the fact you took the time to write commentary and it may actually prove helpful, but it was definitely below the answer quality threshold. Still, since you lack the reputation to write an actual comment, I understand why you wrote it as an answer ...
    – 0xC0000022L ♦
    Sep 5, 2020 at 9:58

1 Answer 1

Reset to default
1

I have done some academic research in the field of malware classification. It is not an easy task, and I don't know what similarity you are looking for, but I can list mostly used static features for binary classification, at least for malicious/unknown software.

  • Header information: dynamic libraries, sections
  • File size
  • Debug information
  • Executable code: disassembled instructions, opcodes, bytes (as arrays, probability vectors, and n-grams), code flow graph
  • Data and strings
  • Entropy can be used for different sections or a whole file
  • Mapping one-dimensional byte array to two-dimensional grayscale image and using image classification methods

We are not at a point where we can fully use these binary features and machine learning models in commercial products. It may help you if you can tolerate some false-positive classification. GitHub has lots of malware classification examples you can work on.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.