Skip to main content
Contribution to Book
Software Similarity and Metamorphic Detection
Proceedings of the International Conference on Security and Management SAM'12 (2012)
  • Mausami Mungale, San Jose State University
  • Mark Stamp, San Jose State University
Abstract
In this paper, we consider a novel method for measuring the similarity of software. Our technique can be applied to any executable file and no special effort is required when developing the software. In addition, our similarity score can be computed at any point in time—even after the software has been distributed. Our approach was inspired by the success of previous research focused on detecting metamorphic computer viruses. Here, we train a hidden Markov model (HMM) on an opcode sequence extracted from a specific piece of software (the “base” software). This trained model can then be used to score another piece of software, giving a measure of its similarity to the base software. We provide experimental results that show our scheme is robust in the sense that we can extensively modify the base software and still obtain strong scores from the trained HMM. Interestingly, the work presented here has some implications for the metamorphic detection problem that served as the original motivation. We briefly discuss the connections between these two problems.
Publication Date
July 16, 2012
Editor
Kevin Daimi and Hamid R. Arabnia
Publisher
CSREA Press
ISBN
1-60132-230-5
Citation Information
Mausami Mungale and Mark Stamp. "Software Similarity and Metamorphic Detection" Proceedings of the International Conference on Security and Management SAM'12 (2012) p. 427 - 433
Available at: http://works.bepress.com/mark_stamp/70/