KR101579347B1 - Method of detecting software similarity using feature information of executable files and apparatus therefor - Google Patents

Abstract

A software similarity detection method and apparatus using feature information of an executable file are disclosed. The method of detecting similarity according to the present invention includes the steps of disassembling executable files of a first and a second software to be compared, that is, a first executable file and a second executable file, Dividing the disassembled result of the first executable file into a plurality of blocks including a function call instruction, and calculating a degree of similarity between the blocks of the first executable file and the blocks of the second executable file. Therefore, when the method according to the present invention is used, efficient illegal copying or detection of plagiarism can be performed based on the binary executable file constituting the software without using the source code.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a software similarity detection method and apparatus using feature information of an executable file,

The present invention relates to a method and apparatus for detecting the similarity of software, and more particularly, to a method for detecting similarity between software by extracting unique information of a binary executable file in order to prevent copyright infringement that may occur due to software source code theft And apparatus.

With the development of communication such as the Internet, software piracy and plagiarism are soaring, which is a stumbling block to the development of the software industry.

Piracy of software means copying and distributing certain software as it is, and plagiarism / theft of software means reverse engineering of whole or partial code of software. And the like.

The first method is to compare the similarity between the source codes of the comparative software and the second method is to compare the similarities between the executable files of the comparative software .

The first method is a method of comparing the token sequence extracted from the source codes or the syntax tree. It is necessary to obtain the source code of the software to be basically compared, It is difficult to apply the present invention to a situation in which it is not easy.

 The second method is to compare feature information extracted from program executables. However, research on most existing feature information focuses on defining and extracting feature information of Java programs. There is little research on the definition and extraction methods of feature information of programs.

In order to solve the above problems, an object of the present invention is to extract characteristic information of executable files to detect plagiarism or theft of software using only executable files without referring to source codes constituting software, And a method for detecting the similarity of the images.

It is another object of the present invention to solve the above problems, and it is an object of the present invention to extract characteristic information of executable files to detect plagiarism or theft of software using only executable files without referring to source codes constituting software, And an apparatus for detecting the similarity of software.

According to an aspect of the present invention, there is provided a method of analyzing a program, the method comprising: (a) disassembling executable files of a first and a second software to be compared, the first executable file and the second executable file; (B) dividing the disassembled result of the second executable file into a plurality of blocks including a function call instruction and calculating a degree of similarity between the blocks of the first executable file and blocks of the second executable file (C) of detecting the similarity of the software.

Here, in the step (b), the blocks may include a predetermined number of instructions before and after the function call instruction.

In this case, the number of instructions before and after the function call instruction included in the block may be determined based on an argument of the function. At this time, the number of instructions before and after the function call instruction included in the block may be determined based on a return value of the function.

Here, the step (c) may include a step of, for m (m is a natural number) blocks of the first executable file and n (n is a natural number) blocks of the second executable file, m blocks And calculate the similarity value for n blocks of the second executable file with respect to each of the n executable files.

At this time, the similarity value may be calculated as a Jaccard similarity or a cosine similarity based on a set or order of assembly codes constituting the comparison blocks. Wherein the step (c) comprises: determining the highest similarity values among the similarity values of n blocks of the second execution file for each of m blocks of the first execution file, and determining an average of the highest similarity values And calculating the similarity value between the first executable file and the second executable file.

According to another aspect of the present invention, there is provided an information processing apparatus including a storage unit for storing executable files of a first software and a second software to be compared, the first executable file and the second executable file, A block dividing unit for dividing the disassembled result of the first and second executable files into a plurality of blocks including a function call instruction, and a block dividing unit for dividing the blocks of the first executable file, And a similarity calculating unit for calculating a similarity between blocks of the two execution files.

Here, the block division unit may be configured to divide the blocks including a predetermined number of instructions before and after the function call instruction.

In this case, the number of instructions before and after the function call instruction included in the block may be determined based on an argument of the function. At this time, the number of instructions before and after the function call instruction included in the block may be determined based on a return value of the function.

Here, the similarity calculation unit may calculate, for each of m blocks (m is a natural number) of the first executable file and n (n is a natural number) blocks of the second executable file, The similarity value to the n blocks of the second execution file.

At this time, the similarity value may be calculated as a Jaccard similarity or a cosine similarity based on a set or order of assembly codes constituting the comparison blocks. The similarity calculation unit may determine the highest similarity values among the similarity values of n blocks of the second execution file for each of m blocks of the first execution file, And calculating the similarity value between the executable file and the second executable file.

When the method and apparatus for detecting the similarity of software according to the present invention as described above are used, unique information is extracted from a binary file to detect whether or not the source code is stolen, and comparison of actual binary files is performed using the extracted unique information .

That is, when using the method and apparatus according to the present invention, it is possible to efficiently detect illegal copying or plagiarism based on a binary executable file constituting software without using a source code.

FIG. 1 is a flow chart for explaining an example of a software similarity detection method according to the present invention.
FIG. 2 is a conceptual diagram for explaining a process of dividing an executable file constituting software into blocks in a software similarity detection method according to the present invention.
FIG. 3 is a conceptual diagram for explaining a process of comparing similarities in units of blocks of execution files in the method of detecting similarity of software according to the present invention.
FIG. 4 is a block diagram illustrating an exemplary configuration of a software similarity detecting apparatus for performing a software similarity detecting method according to the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings.

The configuration of the software similarity detection method according to the present invention

FIG. 1 is a flow chart for explaining an example of a software similarity detection method according to the present invention.

Referring to FIG. 1, an exemplary method for detecting the similarity of software according to the present invention includes disassembling executable files of a first and a second software to be compared, that is, a first executable file and a second executable file, (S120) of dividing the disassembled result of the first and second executable files into a plurality of blocks including a function call instruction (S120) And calculating a degree of similarity between the blocks of the executable file (S130).

First, in step S110, an executable file to be directly subjected to comparison is extracted from the software to be subjected to the similarity calculation, that is, the software to be compared, .

Hereinafter, the execution files extracted from the comparison target software and directly subjected to comparison can be referred to as a first execution file and a second execution file, respectively.

In this case, the executable file extracted from the software may be a main executable file of the corresponding software, or an executable file that implements core functions among a plurality of executable files constituting the corresponding software. However, the first executable file and the second executable file should be selected as executable files that perform mutually corresponding functions.

In the following description, only two comparison target execution files, which are referred to as a first execution file and a second execution file, are specified, but according to an embodiment, a plurality of execution files are extracted from software to be compared, It is also possible to calculate the degree of similarity.

An IDApro disassembler may be used as a disassembler used in the disassembling process. However, various other disassemblers may be used depending on the purpose of the processor and the hardware platform.

Next, in step S120, the disassembled result of the first executable file and the second executable file is divided into a plurality of blocks.

The characteristics of the executable files can be determined by an application programming interface (API) provided by the operating system, which is mainly executed by the executable file, and a user-defined function created by the developer included in the executable file.

In the method of detecting the similarity of software according to the present invention, the executable file is divided into blocks in consideration of this. In this case, each block includes a function call command (for example, a call command as assembly code). In addition, each block is configured to include instructions before and after the function call instruction so as to better describe the characteristics of each block.

The number of instructions before and after the function call instruction included in each block may have a fixed value or may be determined based on an argument of the function at the time of function call. Alternatively, the number of instructions before and after the function call instruction included in each block can be determined based on the return value of the function. Alternatively, the number of instructions before and after the function call instruction included in each block may be determined based on both the function argument and the return value of the function at the time of the function call.

For example, when there are many function arguments (return values) at the time of function call, it is possible to increase the number of commands before and after the function call instruction included in the block. If the function arguments (return value) You can reduce the number of commands before and after the included function call instruction. Of course, the relationship between the above-mentioned function parameter, the function return value, and the number of commands included in the block can be reversely configured.

In addition, the number of instructions included in the block can be variably controlled based on the data type of the arguments of the function or the return value or other characteristics.

FIG. 2 is a conceptual diagram for explaining a process of dividing an executable file constituting software into blocks in a software similarity detection method according to the present invention.

Referring to FIG. 2, an executable file (first executable file) is illustratively divided into three blocks 210, 220 and 230 in total.

In FIG. 2, the block division of the first executable file is illustrated, but block division may be performed for the second executable file through a similar process.

The first block 210 is configured to have two instructions before and after the function call instruction 211 and the second block 220 is configured to have two instructions after the function call instruction 221 And the third block 230 is composed of two instruction words before and after the function call instruction 231.

As a result, the set of assembly codes 261 constituting the first block is composed of {mov, push, call, neg, sbb}, and the set of assembly codes 262 constituting the second block consists of {xor, xor , call, mov, pop}, and the set of assembly codes 263 constituting the third block is composed of {push, push, call, pop, pop}.

In FIG. 2, the first, second, and third blocks are exemplified as including two instruction words before and after the function call instruction. However, in actual implementation, each block includes a different number of instructions .

Next, in step S130, a process of calculating the degree of similarity between the blocks of the first execution file and the blocks of the second execution file is performed.

The process of calculating the similarity is performed by using m blocks (m is a natural number) taken from the first executable file and n blocks (n is a natural number) taken from the second executable file, And calculating the degree of similarity between the n blocks of the second execution file.

On the other hand, the m blocks of the first execution file and the n blocks of the second execution file, in which the similarity degree calculation is used in step S130, necessarily mean all the blocks extracted from the first execution file and the second execution file no. That is, n blocks from the blocks constituting the first executable file and m blocks from the blocks constituting the second executable file may be selectively used for calculating the degree of similarity.

FIG. 3 is a conceptual diagram for explaining a process of comparing similarities in units of blocks of execution files in the method of detecting similarity of software according to the present invention.

Referring to FIG. 3, n pieces of the second executable files 320 (see FIG. 3) are generated for m blocks (311, 312, 313 in FIG. 3) of the first executable file 310, (N = 3) blocks 321, 322, and 323, respectively.

That is, in the above-described example, a total of m x n similarity calculations can be performed. The calculation of the degree of similarity can be performed by a Jacquard similarity calculation or a cosine similarity calculation based on a set of assembly codes or sequences (sequences) constituting each block.

Finally, in step S130, the highest similarity value among the similarity values in the blocks of the second execution file with respect to each block of the first execution file is taken, and the average of all the maximum similarity values is taken, The similarity value of the second executable file.

The configuration of the software similarity detection apparatus according to the present invention

FIG. 4 is a block diagram illustrating an exemplary configuration of a software similarity detecting apparatus for performing a software similarity detecting method according to the present invention.

Referring to FIG. 4, an exemplary configuration 400 of a software similarity degree detecting apparatus according to the present invention includes storing first and second executable files of a first and a second software to be compared, that is, a first executable file and a second executable file A disassembly unit 420 for disassembling the first and second executable files, a plurality of blocks including a function call instruction, a disassembled result of the first and second executable files, And a similarity calculation unit 440 for calculating a degree of similarity between the blocks of the first execution file and the blocks of the second execution file.

First, the storage unit 410 stores a first executable file 411 and a second executable file 412, which are extracted from the first software and the second software to be compared and subjected to direct similarity comparison, to be.

4, the storage unit 410 stores only the first execution file and the second execution file. However, the storage unit 410 may include a disassembly unit 420, a block division unit 430, And the similarity calculation unit 440, and stores the output results of the respective components, and can be referred to the performance of other components. That is, the storage unit 410 may be configured to store the result of disassembly of the first executable file and the second executable file by the disassembler 420, and the block dividing unit 430 may store the result of disassembling the first executable file and the second executable file, And may be configured to store the result of the division. The similarity calculating unit 440 may be configured to calculate the similarity with reference to the block division result and the disassembly result stored in the storage unit 410.

Next, the disassembly unit 420 may read the first executable file and the second executable file from the storage unit 410 and perform disassembly, and store the disassembled result in the storage unit 410 have.

The disassembly unit 420 may be constituted by program codes together with the block dividing unit 430 and the similarity calculating unit 440 to be described later and may be implemented by a central processing unit And can be configured as a combination of a program code and a processor. The disassembly unit 420 may be typically a processor and a memory device capable of performing an IDApro disassembler and a disassembler.

Next, the block dividing unit 430 reads the disassembled result of the first executable file and the second executable file from the storage unit 410, divides the disassembled result into a plurality of blocks, And store it in the storage unit 410.

As mentioned above, the characteristics of the executable files can be mainly determined by an API (Application Programming Interface) provided by the operating system and a user-defined function created by the developer. The block division part of the software similarity detection apparatus according to the present invention is also divided into blocks by dividing an executable file into blocks, each of which includes a function call instruction (for example, a call instruction as assembly code).

In addition, each block is configured to include instructions before and after the function call instruction so as to better describe the characteristics of each block.

The number of instructions before and after the function call instruction included in each block may have a fixed value or may be determined based on an argument of the function at the time of function call. Alternatively, the number of instructions before and after the function call instruction included in each block can be determined based on the return value of the function. Alternatively, the number of instructions before and after the function call instruction included in each block may be determined based on both the function argument and the return value of the function at the time of the function call.

For example, when there are many function arguments (return values) at the time of function call, it is possible to increase the number of commands before and after the function call instruction included in the block. If the function arguments (return value) You can reduce the number of commands before and after the included function call instruction. In addition, the number of instructions included in the block can be variably controlled based on the data type of the arguments of the function or the return value or other characteristics.

Since an example related to the block dividing process has been described with reference to FIG. 2 described above, further explanation will be omitted below.

Finally, the similarity calculation unit 440 is a component for calculating the degree of similarity between the blocks of the first execution file and the blocks of the second execution file.

The similarity calculation unit 440 calculates the similarity of the mth block of the first executable file using m blocks (m is a natural number) taken from the first execution file and n blocks (n is a natural number) taken from the second execution file, And calculating the degree of similarity of n blocks of the second executable file with respect to each of the first executable file and the second executable file.

On the other hand, the m blocks of the first execution file and the n blocks of the second execution file in which the similarity degree calculation is used do not necessarily mean all blocks extracted from the first execution file and the second execution file, respectively. That is, n blocks from the blocks constituting the first executable file and m blocks from the blocks constituting the second executable file may be selectively used for calculating the degree of similarity. The calculation of the degree of similarity can be performed by a Jacquard similarity calculation or a cosine similarity calculation based on a set of assembly codes or sequences (sequences) constituting each block.

The concept of calculating the degree of similarity for each block in the similarity calculation process is the same as that described above with reference to FIG. 3, so that redundant description is omitted.

Finally, the similarity calculation unit 440 takes the highest similarity value among the similarity values among the blocks of the second execution file for each block of the first execution file, and takes an average of all the maximum similarity values, And the second executable file.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the present invention as defined by the following claims It can be understood that

400: Software similarity detection device
410:
420: disassembly unit 430: block dividing unit
440:

Claims (14)

(A) disassembling executables of the first and second software to be compared, the first executable file and the second executable file;
(B) dividing the disassembled result of the first and second executable files into a plurality of blocks each including one function call instruction; And
(C) calculating a degree of similarity between the blocks of the first executable file and the blocks of the second executable file,
Wherein each of the plurality of blocks includes the one function call instruction included in each block and a predetermined number of other instructions before and after the one function call instruction. delete The method according to claim 1,
Wherein the number of instructions before and after the one function call instruction included in each block is determined based on an argument of the function. The method according to claim 1,
Wherein the number of instructions before and after the one function call instruction included in each block is determined based on a return value of the function. The method according to claim 1,
Wherein the step (c) comprises: for each of m blocks (m is a natural number) of the first executable file and n (n is a natural number) blocks of the second executable file, And calculating a similarity value for n blocks of the second executable file. The method of claim 5,
Wherein the calculation of the similarity value is performed by using a Jacquard similarity degree or a cosine similarity degree as the set or order of the assembly codes constituting the blocks to be compared. The method of claim 5,
Determining the highest similarity values among the similarity values of n blocks of the second execution file for each of m blocks of the first execution file and comparing the average of the highest similarity values to the first execution file and the second And calculating the similarity value of the executable file as the similarity value of the executable file. A storage unit for storing executable files of first and second software to be compared, a first executable file and a second executable file;
A disassembly unit for disassembling the first and second executable files;
A block divider for dividing the disassembled result of the first and second execution files into a plurality of blocks each including one function call instruction; And
And a similarity calculation unit for calculating a degree of similarity between the blocks of the first execution file and the blocks of the second execution file,
Wherein each of the plurality of blocks includes the one function call instruction included in each block and a predetermined number of other instructions before and after the one function call instruction. delete The method of claim 8,
Wherein the number of instructions before and after the one function call instruction included in each block is determined based on an argument of the function. The method of claim 8,
Wherein the number of instructions before and after the one function call instruction included in each block is determined based on a return value of the function. The method of claim 8,
Wherein the similarity calculation unit calculates the degree of similarity for each of m blocks of the first executable file (m is a natural number) and n blocks of the second executable file (n is a natural number) 2 < / RTI > executable file. ≪ RTI ID = 0.0 > 21. < / RTI > The method of claim 12,
Wherein the calculation of the similarity value is performed by using a Jacquard similarity degree or a cosine similarity degree as the set or order of the assembly codes constituting the blocks to be compared. The method of claim 12,
Wherein the similarity calculating unit determines the highest similarity values among the similarity values of n blocks of the second execution file for each of the m blocks of the first execution file and outputs the average of the highest similarity values to the first execution file And the similarity value of the second executable file.

Images