Research and implementation of obfuscation binary code similarity detection

Abstract

The problem of binary code similarity detection has made significant progress in malware detection. The comparison of similarity by file bytecode, assembly code, control flow graph, and so on has been applied sufficiently. Nevertheless, the above method must be revised in practical application to judge the similarity of artificially obfuscating binary code. Therefore, this paper proposes a method based on deep learning for binary similarity comparison, which works directly on function disassembly instruction sequences without manual feature extraction. Through the experiment, the improved method can get a good effect on the similarity detection of the binary code which has been obfuscated.