Volume 13 Number 5 (May 2018)
Home > Archive > 2018 > Volume 13 Number 5 (May 2018) >
JCP 2018 Vol.13(5): 545-554 ISSN: 1796-203X
doi: 10.17706/jcp.13.5.545-554

A Bit Vector Based Binary Code Comparison Method for Static Malware Analysis

Ki-Su Kim1, Hyo-Jeong Shin2, Hyong-Shik Kim1
1Department of Computer Science & Engineering, Chungnam National University, Daejeon, korea.
2Software Research Center, Chungnam National University, Daejeon, korea.

Abstract—As variants of malicious codes have made it difficult and complicated to detect possible threat in the Internet, it is one of the most important challenges to analyze the malwares correctly in a timely manner. It has been also observed that we need static analysis as well as dynamic analysis to detect the malware correctly. In this paper, we define a bit vector to characterize a binary code, and utilize it for static malware analysis. Since each bit of a bit vector is organized to indicate the existence of a certain function or code block, we could replace a comparison operation on binary codes by simple logical operations. Common features of a group of binary codes could be also captured by bit vectors, which would be used to determine whether another binary code is similar to those of the group or not. Experimental results show that the bit vector could be effectively utilized to do static malware analysis, and that the group bit vectors could help classify the malwares into their appropriate groups.

Index Terms—Binary code comparison, static malware analysis, bit vector representation.

[PDF]

Cite: Ki-Su Kim, Hyo-Jeong Shin, Hyong-Shik Kim, "A Bit Vector Based Binary Code Comparison Method for Static Malware Analysis," Journal of Computers vol. 13, no. 5, pp. 545-554, 2018.

General Information

ISSN: 1796-203X
Frequency: Monthly (2006-2014); Bimonthly (Since 2015)
Editor-in-Chief: Prof. Liansheng Tan
Executive Editor: Ms. Nina Lee
Abstracting/ Indexing: DBLP, EBSCO, DOAJ, ProQuest, INSPEC, ULRICH's Periodicals Directory, WorldCat, CNKI,etc
E-mail: jcp@iap.org
  • Sep 26, 2017 News!

    Papers published in JCP Volume 12 have all been indexed by DBLP   [Click]

  • Sep 02, 2016 News!

    Vol 11, No 3 has been indexed by EI (Inspec)   [Click]

  • Sep 22, 2017 News!

    Vol 13, No 6 has been published with online version 11 papers are published in this issue after peer review   [Click]

  • Aug 14, 2017 News!

    Vol 13, No 5 has been published with online version   [Click]

  • Jun 21, 2017 News!

    Vol 13, No 4 has been published with online version   [Click]

  • Read more>>