JP2011086147A - Device, method and program for calculating similarity - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To highly accurately calculate the similarity of machine word instruction strings by a small amount of computational complexity. <P>SOLUTION: A similarity calculation device 10 includes: a contracted instruction string generation part 14c for generating a contracted instruction string 13b which is an array of contracted instructions obtained by excluding operand portions of respective machine word instructions included in a machine word instruction string; a longest common section string extraction part 14d for mutually comparing contracted instruction strings 13b generated by the contracted instruction string generation part 14c and extracting the longest common section string; and a similarity calculation part 14e for calculating the similarity of the respective machine word instruction strings on the basis of the longest common section strings extracted by the longest common section string extraction part 14d. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a similarity calculation device, a similarity calculation method, and a similarity calculation program for calculating the similarity of machine language instruction sequences.

  In recent years, with the spread of networks such as the Internet, measures against malware such as computer viruses and worms have become costly. One of the reasons for the cost of malware countermeasures is that the malware authors are actively developing variants, which increases the number of malware types and takes time to analyze malware. .

  Therefore, research to reduce the analysis cost by classifying malware is being conducted. There are two methods for classifying malware: a method of classifying based on behavior and a method of classifying based on program code (machine language instruction sequence).

  In the method of classifying based on behavior, an environment in which access to system resources such as a file system and a network can be monitored is prepared, and information on the behavior of the malware is acquired by actually operating the malware in the environment. And the malware is classified by regarding the similarity of the information regarding the acquired behavior as the similarity of the malware (see Non-Patent Document 1).

  On the other hand, the classification based on the program code allows classification based on the functions inherent in malware, unlike the behavioral technique. As a method of classifying based on the program code, there are several methods as described below depending on the method of calculating the similarity of the program code.

  In one method, a sequence of instruction types is extracted by disassembling the program code, and N-perms that frequently appear (N instruction type sequences having no order) are used as features, so that the degree of malware similarity is increased. Is calculated (see Non-Patent Document 2). According to this method, it can be expected that the influence of instruction replacement generated by compiler optimization is mitigated by using N-perms that do not have order as compared with N-grams that have order. In another method, the program code is disassembled to construct a call tree (a tree representing a function calling relationship), and the similarity of the tree structure is regarded as the similarity of malware (see Non-Patent Document 3). .

JP 2009-193161 A

M. Bailey, J. Oberheide, J. Andersen, ZM Mao, F. Jahanian, and J. Nazario. "Automated classification and analysis of internet malware". In Proceedings of the 10th Symposium on Recent Advances in Intrusion Detection (RAID'07 pages 178--197, 2007. Karim, M. E., Walenstein, A., Lakhotia, A., and Parida, L. "Malware Phylogeny Generation using Permutations of Code". European Research Journal of Computer Virology 1, 1-2 (Nov. 2005) 13--23. Ero Carrera and Gergely Erdelyi, "Digital Genome Mapping-Advanced Binary Malware Analysis". Virus Bulletin Conference September 2004. D.S.Hirschberg, A linear space algorithm for computing maximal common subsequences, Comm.Assoc.Comput.Mach., 18: 6, 341.343, 1975. Maxime Crochemore, Costas S. Iliopoulos, Yoan J. Pinzon: Speeding-up Hirschberg and Hunt-Szymanski LCS Algorithms. Fundam. Inform. 56 (1-2): 89-103 (2003)

  However, among the above-mentioned conventional techniques, the method of classifying based on behavior is easily realized because the malware itself does not need to be analyzed, but it does not operate without instructions from an attacker like a bot. For, there was a problem that it was difficult to classify because it was difficult to confirm the behavior.

  Of the methods classified based on the program code, the method using N-perms increases the similarity even if the malware is completely different when N is small, and with a slight difference when N is large. Even if it exists, there existed a problem of having a big influence on similarity. Further, since the statistical information of N-perms is compared, there is a problem that it is difficult to calculate exactly where the compared malware matches and where does not match.

  In addition, the method using the similarity of the call tree requires a large amount of calculation, and since only the function call relationship is a characteristic of the malware, the similarity may be high even for completely different malware. There was a problem.

  The present invention has been made in view of the above, and a similarity calculation device, a similarity calculation method, and a similarity that can calculate the similarity of a machine language instruction sequence such as malware with a small amount of calculation with high accuracy An object is to provide a calculation program.

  In order to solve the above-described problems and achieve the object, the present invention is a similarity calculation device for calculating the similarity of a plurality of machine language instruction sequences, and for each of the plurality of machine language instruction sequences, a machine language Reduced instruction sequence generating means for generating a reduced instruction sequence that is an array of reduced instructions obtained by removing the operand portion from each machine language instruction included in the instruction sequence, and the reduction generated by the reduced instruction sequence generating means The longest common partial sequence extracting means for comparing the instruction sequences and extracting the longest common partial sequence, and the similarity of the machine language instruction sequence based on the longest common partial sequence extracted by the longest common partial sequence extracting means. And a similarity calculating means for calculating.

  In another aspect, the present invention provides a similarity calculation method for calculating a similarity between a plurality of machine language instruction sequences, wherein each machine included in a machine language instruction sequence is included in each of the plurality of machine language instruction sequences. A reduced instruction sequence generating step for generating a reduced instruction sequence that is an array of reduced instructions obtained by removing an operand part from a word instruction and the reduced instruction sequence generated in the reduced instruction sequence generating step; A longest common subsequence extraction step for extracting the longest common subsequence, and a similarity calculation step for calculating the similarity of the machine language instruction sequence based on the longest common subsequence extracted in the longest common subsequence extraction step; It is characterized by including.

  In another aspect, the present invention provides a similarity calculation program for calculating similarity between a plurality of machine language instruction sequences, wherein each machine included in a machine language instruction sequence is included in each of the plurality of machine language instruction sequences. A reduced instruction string generation procedure that generates a reduced instruction string that is an array of reduced instructions obtained by removing operand parts from word instructions and the reduced instruction string generated by the reduced instruction string generation procedure; A longest common subsequence extraction procedure for extracting the longest common subsequence, and a similarity calculation procedure for calculating the similarity of the machine language instruction sequence based on the longest common subsequence extracted by the longest common subsequence extraction procedure; Is executed by a computer.

  The similarity calculation device, the similarity calculation method, and the similarity calculation program according to the present invention have an effect that the similarity of the machine language instruction sequence can be calculated with a small amount of calculation with high accuracy.

FIG. 1 is a block diagram illustrating the configuration of the similarity calculation apparatus according to the first embodiment. FIG. 2 is a diagram illustrating an example of the configuration of the contracted instruction. FIG. 3 is a diagram illustrating an example of similarity matrix data. FIG. 4 is a flowchart illustrating the operation of the similarity calculation apparatus according to the first embodiment. FIG. 5 is a block diagram illustrating the configuration of the similarity calculation apparatus according to the second embodiment. FIG. 6 is a diagram illustrating an example of difference analysis result data. FIG. 7 is a flowchart illustrating the operation of the similarity calculation apparatus according to the second embodiment. FIG. 8 is a functional block diagram illustrating a computer that executes the similarity calculation program.

  Embodiments of a similarity calculation device, a similarity calculation method, and a similarity calculation program according to the present invention will be described below in detail with reference to the drawings. In the following embodiments, the case where the similarity calculation device, the similarity calculation method, and the similarity calculation program according to the present invention are used for calculating the similarity of malware will be described. Is not limited.

  First, the configuration of the similarity calculation apparatus 10 according to the present embodiment will be described. FIG. 1 is a block diagram illustrating a configuration of the similarity calculation apparatus 10. As illustrated in FIG. 1, the similarity calculation device 10 includes a display unit 11, an input unit 12, a storage unit 13, and a control unit 14.

  The display unit 11 is, for example, a liquid crystal display device or an organic EL (Electro-Luminescence) display device, and displays various types of information to the user. The input unit 12 includes, for example, a keyboard and a mouse, and receives instructions from the user. Note that the display unit 11 and the input unit 12 are not essential components. For example, the similarity calculation is performed so that an instruction from the user is received via the network and a response to the received instruction is transmitted to the user via the network. The apparatus 10 may be configured.

  The storage unit 13 is, for example, a hard disk device or a semiconductor memory, and stores various electronic information such as the execution module 13a. The execution module 13a is, for example, malware, and includes a machine language instruction sequence for which similarity is calculated, a data sequence used by the machine language instruction sequence, and the like. The execution module 13a is stored in the storage unit 13 via a storage medium such as a network or a DVD, for example.

  The storage unit 13 is also used as a storage location for the contracted instruction sequence 13b generated by the control unit 14 as intermediate data and the similarity matrix data 13c generated by the control unit 14 as a processing result.

  The control unit 14 is a control unit that controls the similarity calculating apparatus 10 as a whole, and is similar to the unpacking unit 14a, the disassembly unit 14b, the reduced instruction sequence generation unit 14c, and the longest common partial sequence extraction unit 14d. And a sex calculation unit 14e.

  The unpacking unit 14a performs an unpacking process on each execution module 13a stored in the storage unit 13 and outputs it to the disassembly unit 14b. In many malware, a process called packing is applied to make analysis difficult, and the original machine language instruction sequence is concealed. When the execution module 13a is packed, the unpacking unit 14a reproduces the original machine language instruction sequence by using an existing unpacking technique. When the execution module 13a is not packed, the unpacking unit 14a outputs the execution module 13a as it is to the disassembly unit 14b.

  The disassembly unit 14b disassembles the execution module 13a input from the unpacking unit 14a, and outputs the disassembled machine language instruction sequence to the contracted instruction sequence generation unit 14c. As described above, the execution module 13a includes a data string to be processed in addition to the machine language instruction sequence, but the disassembly unit 14b is a reduced instruction sequence generation unit that generates only the disassembly result of the machine language instruction sequence. To 14c. The selection of the machine language instruction sequence included in the execution module 13a can be realized using, for example, the technique disclosed in Patent Document 1.

  The contracted instruction sequence generation unit 14c generates a contracted instruction sequence from the machine language instruction sequence input from the disassemble unit 14b. Here, the contracted instruction is an instruction in which the operand part is deleted from the machine language instruction, and the contracted instruction sequence is an array of contracted instructions converted from each machine language instruction included in the machine language instruction sequence. Say.

  For example, when the machine language instruction is a branch instruction, the operand part of the machine language instruction includes branch destination information. The branch destination information is obtained by adding a new instruction between the branch source and the branch destination when the execution module is modified, such as when a malware variant is created by the malware author. It may change.

  The absolute address required for memory access is also specified as an operand, but when the execution module is implemented as a dynamic link library, the address to be loaded is not constant, and depending on the timing at which the library is loaded Absolute address changes.

  As described above, the contents of the operand portion of the machine language instruction may change even when the machine language instruction sequence is not substantially modified. For this reason, when a machine language instruction sequence including an operand part is used for calculating the similarity, even a part of the machine language instruction string that is not substantially modified may be determined as a different part.

  Therefore, in the similarity calculation method according to the present embodiment, the similarity is calculated using the reduced instruction sequence from which the operand portion is removed. By calculating the similarity using the reduced instruction sequence from which the operand part is removed, the similarity of the machine language instruction sequence can be calculated with high accuracy without being affected by the change in the contents of the operand part. become.

  Here, the contracted instruction generated by converting the contracted instruction sequence generation unit 14c from the machine language instruction will be described in more detail by taking the case of the IA-32 instruction set as an example. The machine language instruction in the IA-32 instruction set includes a prefix part that is an instruction modifier, an opcode part that represents an instruction type, Mod / RM and SIB that represent an operand type, and an address part when the operand is in memory. Consists of an immediate part when the operand is an immediate value.

  The prefixes in the IA-32 instruction set are divided into four groups. There are three types of prefixes in group 1, six types in group 2, one type in group 3, and one type in group 4. Will select less than one prefix. Regarding the operation code, when the first byte is other than 0x0F, the value is the value, and when the first byte is 0x0F, the value of the second byte is the substantial operation code. When the opcode is determined, the presence / absence of an operand, the presence / absence of Mod / RM, and the presence / absence of an immediate value are determined. Further, the presence / absence of an SIB is determined by the value of Mod / RM, and the presence / absence of an address portion is determined by the value of SIB.

  In the present embodiment, a prefix instruction, an opcode part, Mod / RM and SIB information are used in combination as contraction instructions. An example of the configuration of the contracted instruction in this embodiment is shown in FIG. In the example shown in FIG. 2, the contracted instruction includes 2-bit P1, 3-bit P2, 1-bit P3, P4, and OL, and 8-bit OC, M, and S.

  P1 corresponds to the prefix of group 1. Specifically, P1 is “0” when there is no group 1 prefix, and “1” and “2” when the group 1 prefix value is “F0H”, “F2H”, and “F3H”, respectively. "," 3 ". P2 corresponds to the prefix of group 2. Specifically, P2 is “0” when the group 2 prefix does not exist, and the group 2 prefix values are “2EH”, “36H”, “3EH”, “26H”, “64H”, “ In the case of “65H”, they are “1”, “2”, “3”, “4”, “5”, and “6”, respectively.

  P3 corresponds to the prefix of group 3. Specifically, P3 is “0” when there is no group 3 prefix, and “1” when the group 3 prefix value is “66H”. P4 corresponds to the prefix of group 4. Specifically, P4 is “0” when there is no group 4 prefix and “1” when the group 4 prefix value is “67H”.

  OL indicates whether the first byte of the operation code is 0x0F. If the first byte of the operation code is 0x0F, “1” is set. Otherwise, “0” is set. OC is a substantial value of the operation code. If the first byte of the operation code is 0x0F, the value of the second byte of the operation code is set. Otherwise, the value of the first byte of the operation code is set.

  M corresponds to ModR / M. If ModR / M exists, the value of ModR / M is set, otherwise, “0” is set. S corresponds to the SIB, and if the SIB exists, the SIB value is set; otherwise, “0” is set.

  The machine language instructions in the IA-32 instruction set have different lengths depending on the instruction type and the like, but as shown in FIG. 2, the length of the reduced instruction in this embodiment is 32 bits regardless of the instruction type. It becomes a fixed length. The size of 32 bits is the same as the bit width of the general-purpose register in IA-32, and is suitable for efficiently processing the reduced instruction sequence. Also, forming the contracted instruction sequence as an array of fixed-length elements is suitable for easily realizing the common part extraction process using a bit vectorization algorithm described later.

  The longest common subsequence extraction unit 14d extracts the longest common subsequence for all combinations of the reduced instruction sequences generated by the reduced instruction sequence generation unit 14c. For example, when there is a reduced instruction sequence consisting of five instructions {a, b, c, d, e} and a reduced instruction sequence consisting of four instructions {f, b, g, d, h} The common partial sequence of these contracted instruction sequences is {b, d}. The extraction of the longest common subsequence from the contracted instruction sequence is performed, for example, by using an algorithm of calculation amount o (mn) and memory usage amount o (n) based on dynamic programming and divide-and-conquer (see Non-Patent Document 4). By using it, it can be realized with a small amount of calculation. In addition, by applying a technique called bit vectorization to this algorithm, an algorithm (see Non-Patent Document 5) that achieves a speed increase of the number of arithmetic unit bits in a computer can be used.

  Note that the algorithm for applying bit vectorization is o (σn) when the memory usage is σ when the alphabet size of the comparison element is σ. Therefore, it becomes difficult to apply bit vectorization when σ is very large. It is known that there is a problem of becoming. In the similarity calculation method according to the present embodiment, a contracted instruction obtained by removing an operand from a machine language instruction is used as a comparison element, and σ can be reduced compared to the case where a machine language instruction is used as a comparison element. Even when bit vectorization is applied, it is possible to reduce the memory usage.

  The similarity calculation unit 14e calculates similarity for all combinations of execution modules 13a (machine language instruction sequences) based on the length of the longest common partial sequence extracted by the longest common partial sequence extraction unit 14d, and the calculation result Is output as similarity matrix data 13c.

  Assuming that two machine language instruction sequences are A and B, the corresponding reduced instruction sequences are CA and CB, and the lengths of the reduced instruction sequences are L (CA) and L (CB), respectively, CA and CB The longest common subsequence LCS (CA, CB) is extracted by the longest common subsequence extraction unit 14d. Then, assuming that the length of the longest common subsequence LCS (CA, CB) is LLCS (CA, CB), the similarity calculation unit 14e takes a value from 0 to 1 using the following equation (1) and is similar By calculating a Jaccard coefficient representing a ratio, a similarity indicating the similarity between the machine language instruction sequence A and the machine language instruction sequence B is calculated.

  Note that the method using the Jaccard coefficient is an example of a method for calculating similarity based on the length of the longest common subsequence, and other methods may be used as long as the similarity is calculated based on the length of the longest common subsequence. You may use the method of. For example, the length of the longest common subsequence itself may be used as an index of similarity.

  An example of the similarity matrix data 13c output from the similarity calculation unit 14e is shown in FIG. The example shown in FIG. 3 is an example of the similarity matrix data 13c when similarity is calculated for four machine language instruction sequences of the machine language instruction sequences A to D. All of the machine language instruction sequences A to D are illustrated. Similarity is calculated as a Jaccard coefficient for the combinations.

  The machine language instruction sequence may be further clustered based on the similarity matrix data 13c output in this way. By performing clustering based on similarity, for example, if the machine language instruction sequence for which similarity is calculated is malware, it is possible to efficiently grasp the fashion and disuse of malware, or when unknown malware appears It becomes easy to determine the most similar malware.

  As for the similarity matrix data 13c, the similarity calculation device 10 may be configured so that the similarity matrix data 13c can be used in a display unit 11 or a printing device (not shown) in the form of a table or a graph. The similarity calculation device 10 may be configured so that the similarity matrix data 13c can be transferred to another device via a network or a storage medium.

  Next, the operation of the similarity calculation apparatus 10 shown in FIG. 1 will be described with reference to the flowchart shown in FIG. Here, it is assumed that all the execution modules 13a for which similarity is calculated are stored in the storage unit 13 in advance.

  As shown in FIG. 3, the unpacking unit 14a selects one of the execution modules 13a stored in the storage unit 13 that has not been selected (step S101). If it can be selected (No at Step S102), the unpacking unit 14a performs an unpacking process on the execution module 13a if the selected execution module 13a is packed (Yes at Step S103), and disassembles the unit. 14b (step S104). On the other hand, if the selected execution module 13a is not packed (No at Step S103), the unpacking unit 14a outputs the execution module 13a as it is to the disassembly unit 14b.

  The disassembly unit 14b disassembles the input execution module 13a to extract a machine language instruction string (step S105). Subsequently, the contracted instruction sequence generation unit 14c generates a contracted instruction sequence 13b from the extracted machine language instruction sequence (step S106). Thus, after the contracted instruction sequence 13b corresponding to the execution module 13a selected in step S101 is generated, the processing procedure is restarted from step S101, and the unpacking unit 14a is stored in the storage unit 13. Attempts to select an unselected one among 13a.

  If all execution modules 13a have been selected in step S101 (Yes in step S102), the longest common partial sequence extraction unit 14d selects one of the unselected combinations of the reduced instruction sequence 13b. (Step S107). If it can be selected (No at Step S108), the longest common subsequence extraction unit 14d extracts the longest common subsequence from the selected combination of the contracted instruction sequences 13b (Step S109). Then, the similarity calculation unit 14e calculates a similarity indicating the similarity of the combination of machine language instruction sequences corresponding to the combination of the contracted instruction sequence 13b selected in step S107 based on the extracted longest common subsequence. Calculate (step S110).

  Thus, after the similarity of the combination of machine language instruction sequences corresponding to the combination of the reduced instruction sequence 13b selected in step S107 is calculated, the processing procedure is restarted from step S107, and the longest common subsequence extraction unit 14d Then, an attempt is made to select an unselected one among the combinations of the contracted instruction sequence 13b. If all combinations have been selected in step S107 (Yes in step S108), the similarity calculation unit 14e generates similarity matrix data 13c from each similarity calculated so far (step S111). A series of processing ends.

  As described above, in this embodiment, since the similarity of the machine language instruction sequence is calculated based on the reduced instruction sequence obtained by removing the operand part of each machine language instruction from the machine language instruction sequence, the machine language The similarity of instruction sequences can be calculated with a small amount of calculation with high accuracy.

  In the first embodiment, a reduced instruction sequence is generated from the machine language instruction sequence, and the similarity of the machine language instruction sequence is calculated based on the length of the longest common subsequence extracted from the reduced instruction sequence. The method of analyzing the similarity between machine language instruction sequences using the reduced instruction sequence is not limited to this. Therefore, in the second embodiment, an example of another method for analyzing the similarity of machine language instruction sequences using a reduced instruction sequence will be described. In the following description, the same parts as those already described are denoted by the same reference numerals as those already described, and redundant description is omitted.

  First, the configuration of the similarity calculation apparatus 20 according to the present embodiment will be described. FIG. 5 is a block diagram illustrating a configuration of the similarity calculation apparatus 20. As illustrated in FIG. 5, the similarity calculation device 20 includes a display unit 11, an input unit 12, a storage unit 23, and a control unit 24.

  The storage unit 23 is shown in FIG. 1 in that the storage unit 23 is used as a storage location of the difference analysis result data 23c generated as the processing result by the control unit 24, not the similarity matrix data 13c generated as the processing result by the control unit 14. This is different from the storage unit 13.

  The control unit 24 is different from the control unit 14 shown in FIG. 1 in that a similarity calculation unit 24e is provided instead of the similarity calculation unit 14e. The similarity calculation unit 24e compares each longest common partial sequence extracted by the longest common partial sequence extraction unit 14d with each of the two contracted instruction sequences from which the longest common partial sequence is extracted. An instruction specific to the contracted instruction sequence is extracted, and difference analysis result data 23c is generated. By extracting an instruction specific to each contracted instruction sequence in this way, for example, it is easy to analyze a malware that has been modified by paying attention to the modified location.

  If the two machine language instruction sequences are A and B, the corresponding reduced instruction sequences are CA and CB, and the lengths of the reduced instruction sequences are L (CA) and L (CB), respectively, the longest common part The longest common partial sequence of CA and CB extracted by the column extraction unit 14d is LCS (CA, CB). In this case, the similarity calculation unit 24e compares LCS (CA, CB) and CA in order from the top, thereby reducing the reduced instruction that is present in CA but not in LCS (CA, CB) and CA. A contraction instruction that also exists in LCS (CA, CB) is specified. Of these, the former corresponds to an instruction specific to CA. Further, the similarity calculation unit 24e compares the LCS (CA, CB) and CB in order from the head, thereby reducing the reduced instruction that exists in the CB but does not exist in the LCS (CA, CB) and the LCS. A contraction instruction that also exists in (CA, CB) is specified. Of these, the former corresponds to an instruction specific to CB.

  An example of the difference analysis result data 23c output by the similarity calculation unit 24e is shown in FIG. The example shown in FIG. 6 is an example of the difference analysis result data 23c when a difference is extracted for a machine language instruction sequence A and a machine language instruction sequence B among a plurality of machine language instruction sequences, and is generated in an XML format. Has been. In the example shown in FIG. 6, in addition to the difference between the machine language instruction sequence A and the machine language instruction sequence B, the instruction included in the longest common partial sequence is the common part of the machine language instruction sequence A and the machine language instruction sequence B. It is output.

  In the example shown in FIG. 6, the tag “machine language instruction sequence 1” indicates that one of the difference extraction targets is the machine language instruction sequence A, and the tag “machine language instruction sequence 2” The other of the extraction targets is a machine language instruction sequence B. The tag “unique contract instruction 1” is a tag including a contract instruction unique to the machine language instruction sequence A, and the tag “unique contract instruction 2” is a contract specific to the machine language instruction sequence B. A tag including a contract instruction, and a tag “common contract instruction” includes a contract instruction unique to the machine language instruction sequence A and the machine language instruction sequence B. Each tag of “unique contract instruction 1”, “unique contract instruction 2”, and “common contract instruction” includes the line number of the contract instruction in the contract instruction sequence and each item of the contract instruction. Zero or more tags “contract instruction” including a value are included.

  In the example shown in FIG. 6, the content of the contracted instruction is output as a difference, but each contracted instruction in the contracted instruction sequence is associated in advance with the machine language instruction of the conversion source in some way, By dynamically specifying the machine language instruction that is the conversion source of the reduced instruction based on the line number of the reduced instruction in the reduced instruction sequence, the contents of the machine language instruction that is the conversion source of the reduced instruction are obtained as a difference. It is good also as outputting.

  For the difference analysis result data 23c, the similarity calculation device 20 may be configured so that the difference analysis result data 23c can be displayed in a tabular format or a graphical format on the display unit 11 or a printing device (not shown). Alternatively, the similarity calculation device 20 may be configured such that the difference analysis result data 23c can be transferred to another device via a storage medium.

  Next, the operation of the similarity calculation apparatus 20 shown in FIG. 5 will be described with reference to the flowchart shown in FIG. Steps S201 to S206 have the same contents as those in the flowchart shown in FIG.

  If all the execution modules 13a have been selected in step S201 (Yes in step S202), the longest common subsequence extraction unit 14d selects one of the combinations of the contracted instruction sequence 13b that has not been selected (step S202). S207). If it can be selected (No at Step S208), the longest common partial sequence extracting unit 14d extracts the longest common partial sequence from the selected combination of the contracted instruction sequences 13b (Step S209). Then, the similarity calculation unit 24e generates difference analysis result data 23c of the combination of the contracted instruction sequence 13b selected in step S207 based on the extracted longest common partial sequence (step S210).

  Thus, after the difference analysis result data 23c of the combination of the contracted instruction sequence 13b selected in step S207 is generated, the processing procedure is restarted from step S207, and the longest common partial sequence extracting unit 14d performs the contracted instruction sequence 13b. Attempts to select an unselected one of the combinations. If all combinations have been selected in step S207 (Yes in step S208), a series of processing procedures is completed.

  As described above, by using the contracted instruction sequence, in addition to calculating the similarity of the machine language instruction sequence based on the length of the longest common subsequence extracted from the contracted instruction sequence, the machine language instruction sequence Can be analyzed in various ways.

  In addition, the implementation form of each Example mentioned above can be variously changed in the range which does not deviate from a summary. For example, the implementation forms of the embodiments can be implemented in combination as appropriate. Further, the functions of the control unit 14 of the similarity calculation device 10 shown in FIG. 1 and the control unit 24 of the similarity calculation device 20 shown in FIG. 2 are implemented as software, and this is executed by a computer. Functions equivalent to those of the calculation device 10 and the similarity calculation device 20 can also be realized. Hereinafter, an example of a computer that executes the similarity calculation program 171 in which the function of the control unit 14 of the similarity calculation apparatus 10 is implemented as software will be described.

  FIG. 8 is a functional block diagram illustrating the computer 100 that executes the similarity calculation program 171. The computer 100 includes a CPU (Central Processing Unit) 110 that executes various arithmetic processes, an input device 120 that receives input of data from a user, a monitor 130 that displays various information, and a medium reading that reads a program from a recording medium. The device 140, a network interface device 150 that exchanges data with other computers via a network, a RAM (Random Access Memory) 160 that temporarily stores various information, and a hard disk device 170 are connected by a bus. Configured.

  The hard disk device 170 has a similarity calculation program 171 having the same function as the control unit 14 shown in FIG. 1, and a machine language instruction corresponding to the execution module 13a stored in the storage unit 13 shown in FIG. Column 172 is stored. Note that the machine language instruction sequence 172 may be stored in a manner that the computer 100 can access another computer connected via a network.

  Then, the CPU 110 reads out the similarity calculation program 171 from the hard disk device 170 and develops it in the RAM 160, whereby the similarity calculation program 171 functions as the similarity calculation process 161. Then, the similarity calculation process 161 appropriately expands the machine language instruction sequence 172 and the like in an area allocated to itself on the RAM 160, executes various data processing based on the expanded data, and the like, as shown in FIG. Calculation result data 173 corresponding to the similarity matrix data 13c is stored in the hard disk device 170 or the like.

  The similarity calculation program 171 is not necessarily stored in the hard disk device 170, and the computer 100 may read and execute the program stored in a storage medium such as a CD-ROM. Good. The computer 100 stores the program in another computer (or server) connected to the computer 100 via a public line, the Internet, a LAN (Local Area Network), a WAN (Wide Area Network), or the like. You may make it read and run a program from these.

  The similarity calculation device, the similarity calculation method, and the similarity calculation program according to the present invention are not only for the purpose of calculating the similarity of a machine language instruction sequence modified based on malicious intentions like malware, but also for example, a mechanism addition It is used for various purposes such as calculating the similarity of machine language instruction sequences modified for the purpose of correcting bugs, etc., and calculating the similarity of machine language instruction sequences suspected of theft of source code. be able to.

DESCRIPTION OF SYMBOLS 10, 20 Similarity calculation apparatus 11 Display part 12 Input part 13, 23 Memory | storage part 13a Execution module 13b Reduction instruction sequence 13c Similarity matrix data 14, 24 Control part 14a Unpacking part 14b Disassembly part 14c Reduction instruction sequence generation Unit 14d longest common subsequence extraction unit 14e, 24e similarity calculation unit 23c difference analysis result data 100 computer 110 CPU
120 Input Device 130 Monitor 140 Medium Reading Device 150 Network Interface Device 160 RAM
161 Similarity calculation process 170 Hard disk device 171 Similarity calculation program 172 Machine language instruction sequence 173 Calculation result data

Claims (7)

A similarity calculation device that calculates the similarity of a plurality of machine language instruction sequences,
Reduced instruction sequence generation means for generating a reduced instruction sequence that is an array of reduced instructions obtained by removing an operand part from each machine language instruction included in the machine language instruction sequence for each of the plurality of machine language instruction sequences;
A longest common partial sequence extracting means for comparing the reduced instruction sequences generated by the reduced instruction sequence generating means and extracting a longest common partial sequence;
A similarity calculation device comprising: similarity calculation means for calculating similarity of the machine language instruction sequence based on the longest common partial sequence extracted by the longest common partial sequence extraction means.   2. The similarity calculation apparatus according to claim 1, wherein the longest common subsequence extraction unit extracts the longest common subsequence from the contracted instruction sequence based on a bit vectorization algorithm.   3. The similarity calculation apparatus according to claim 1, wherein the contracted instruction sequence generation unit generates a contracted instruction sequence that is an array of contracted instructions having a predetermined bit length.   4. The similarity according to claim 1, wherein the similarity calculation unit calculates the similarity of the machine language instruction sequence based on the length of the longest common subsequence. Calculation device.   The similarity calculation apparatus according to claim 1, wherein the similarity calculation unit extracts a difference between the machine language instruction sequences based on the longest common subsequence. A similarity calculation method for calculating the similarity of a plurality of machine language instruction sequences,
For each of the plurality of machine language instruction sequences, a contracted instruction sequence generating step for generating a contracted instruction sequence that is an array of contracted instructions obtained by removing an operand part from each machine language instruction included in the machine language instruction sequence;
A longest common partial sequence extraction step of comparing the reduced instruction sequences generated in the reduced instruction sequence generation step and extracting a longest common partial sequence;
A similarity calculation step of calculating the similarity of the machine language instruction sequence based on the longest common subsequence extracted in the longest common subsequence extraction step. A similarity calculation program for calculating the similarity of a plurality of machine language instruction sequences,
For each of the plurality of machine language instruction sequences, a contracted instruction sequence generation procedure for generating a contracted instruction sequence that is an array of contracted instructions obtained by removing an operand part from each machine language instruction included in the machine language instruction sequence;
A longest common partial sequence extraction procedure for comparing the reduced instruction sequences generated by the reduced instruction sequence generation procedure and extracting the longest common partial sequence;
A similarity calculation program for causing a computer to execute a similarity calculation procedure for calculating similarity of the machine language instruction sequence based on the longest common partial sequence extracted by the longest common subsequence extraction procedure.

Images