A Module-based System for Measuring Similarity of Windows Executable Files (윈도우 실행파일을 위한 모듈 기반 유사도 측정 시스템)

Yesol Kim (김예솔); CHO SANG WOOK (조상욱); Seongasoo Park (박성수); Dong-Kyu Chae (채동규); Seong-Je Cho (조성제); Hwansoo Han (한환수); Sangwook Kim (김상욱); Sangchul Han (한상철)

A Module-based System for Measuring Similarity of Windows Executable Files

Journal of Software Forensics
Abbr : JSF
2014, 10(2), pp.9~15
Publisher : Korea Software Assessment and Valuation Society
Research Area : Engineering > Computer Science
Received : December 29, 2014
Accepted : December 30, 2014
Published : December 31, 2014

Yesol Kim ¹, CHO SANG WOOK ¹, Seongasoo Park ¹, Dong-Kyu Chae ¹, Seong-Je Cho ¹, Hwansoo Han ², Sangwook Kim ³, Sangchul Han ³

¹단국대학교
²
³단국대

ABSTRACT

This paper presents an effective system to measure and compare similarity between Microsoft Windows executable files. When a user inputs two target binary programs in the web interface, the system computes the similarity between them and shows the results. We currently implement four algorithms (modules) for measuring similarity of Windows executable files, and a user can obtain the similarity computed using each algorithm. Our system also provides an integrated similarity measure that quantifies the similarity between two files using the four algorithms at the same time. For the integrated similarity measure, a user can assign a weight for each algorithm. Since we develop each algorithm as an extensible module, it is easy to improve an algorithm or add a new one.

KEYWORDS

Journal Copyright Policy

No CCL information provided

Citation status

* References for papers published after 2025 are currently being built.

[web] / A System for Detecting Software Plagiarism: MOSS (a Measure Of Software Similarity) / http://theory.stanford.edu/~aiken/moss/

[report] Ginger Marie Myles / 2006 / Software theft detection through program identification / University of Arizona

[journal] Haruaki Tamada / 2005 / Java Birthmarks - Detecting the Software Theft - / IEICE Transactions on Information and Systems 88-D(9) : 2148~2158

[confproc] Dongjin Kim / 2013 / Measuring similarity of windows applications using static and dynamic birthmarks / Proceedings of the 28th Annual ACM Symposium on Applied Computing : 1628~1633

[report] Yesol Kim / 2013 / A Static Birthmark of Windows Binary Executables Based on Strings / Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS)

[journal] 박성수 / 2014 / Detecting Software Similarity Using API Sequences on Static Major Paths / 정보과학회논문지 / 한국정보과학회 41(12) : 1007~1012

[confproc] Dong-Kyu Chae / 2013 / Software Plagiarism Detection via the Static API Call Frequency Birthmark / ACM Symposium on Applied Computing(SAC)

[web] / A system for detecting software plagiarism - MOSS / http://theory.stanford.edu/˜aiken/moss/

KJCKorea
Journal Central

Journal of Software Forensics 2025 KCI Impact Factor : 0.3