收稿日期: 2008-05-28
修回日期: 2009-02-20
网络出版日期: 2009-07-15
基金资助
国家自然科学基金项目(60573048,60773135,90718007)和国家"863"计划项目(2007AA01Z427,2007AA01Z450)资助
Algorithm for structural comparison and its software implement
Received date: 2008-05-28
Revised date: 2009-02-20
Online published: 2009-07-15
宋杨 , 张玉清 . 结构化比对算法研究及软件实现[J]. 中国科学院大学学报, 2009 , 26(4) : 549 -554 . DOI: 10.7523/j.issn.2095-6134.2009.4.017
Structural comparison is one of the core components of patch comparison. This paper improves the classic algorithm of structural comparison. Compared with the classic algorithm, the improved algorithm calculates the value of similarity between functions. Therefore, the problem of contradiction between the consistency and exclusiveness of signature is solved. Furthermore, a structural comparison tool named as NBD (NCNIPC binary differ), which gets a higher score compared with other popular tools during the exam towards some patches of microsoft, is constructed based on the improved algorithm.
[1] David B, Pongsin P, Dawn S, et al. Automatic patch-based exploit generation is possible: techniques and implications //2008 IEEE Symposium on Security and Privacy. 2008: 143-157.
[2] Flake H. Structural comparison of executable objects //Detection of intrusions and Malware & Vulnerability Assessment. 2004: 161-173.
[3] Xu L H, Sun Y L, Gao F, et al. Security path comparison techniques based on graph isomorphism theory
[J]. Computer Applications, 2006, 26(7):1623-1625 (in Chinese). 徐良华,孙玉龙,高 丰,等. 基于图形同构理论的安全补丁比较技术
[J]. 计算机应用,2006,26(7):1623-1625.
[4] Zeng M, Zhao R C, Wang X Q, et al. Binary patches analysis based on structural function signature
[J]. Computer Engineering, 2006, 32(14):43-45 (in Chinese). 曾 鸣,赵荣彩,王小芹,等. 基于结构化函数签名的二进制补丁分析
[J]. 计算机工程,2006,32(14):43-45.
[5] Zeng M, Zhao R C, Wang X Q, et al. Security patches analyzing through disassemble technology
[J]. Computer Science, 2007, 33(10): 283-287 (in Chinese). 曾 鸣,赵荣彩,王小芹,等. 一种基于反汇编技术的二进制补丁分析方法
[J]. 计算机科学,2007,33(10): 283-287.
/
| 〈 |
|
〉 |
