基于simhash与倒排索引的复用代码快速溯源方法Fastreusedcode.PDFVIP

第 37 卷第 11 期 通 信 学 报 Vol.37 No.11 2016 年 11 月 Journal on Communications November 2016 doi:10.11959/j.issn.1000-436x.2016225 基于 simhash 与倒排索引的复用代码快速溯源方法 乔延臣 1,2,3 ，云晓春 1,2,3 ，庹宇鹏 2,3 ，张永铮 2,3 (1. 中国科学院计算技术研究所，北京 100080 ； 2. 中国科学院研究生院，北京 100039 ；3. 中国科学院信息工程研究所，北京 100093) 摘 要：提出了一种新颖的复用代码精确快速溯源方法。该方法以函数为单位，基于 simhash 与倒排索引技术， 能在海量代码中快速溯源相似函数。首先基于 simhash 利用海量样本构建具有三级倒排索引结构的代码库。对于 待溯源函数，依据函数中代码块的 simhash 值快速发现相似代码块，继而倒排索引潜在相似函数，依据代码块跳 转关系精确判定是否相似，并溯源至所在样本。实验结果表明，该方法在保证高准确率与召回率的前提下，基于 代码库能快速识别样本中的编译器插入函数与复用函数。 关键词：网络安全；复用代码；快速溯源；同源判定；恶意代码 中图分类号：TP393.08 文献标识码：A Fast reused code tracing method based on simhash and inverted index QIAO Yan-chen1,2,3, YUN Xiao-chun1,2,3,TUO Yu-peng2,3, ZHANG Yong-zheng2,3 (1. Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100080, China; 2. Graduate School, Chinese Academy of Sciences, Beijing 100039, China; 3. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China) Abstract: A novel method for fast and accurately tracing reused code was proposed. Based on simhash and inverted in- dex, the method can fast trace similar functions in massive code. First of all, a code database with three-level inverted in- dex structures was constructed. For the function to be traced, similar code blocks could be found quickly according to simhash value of the code block in the function code. Then the potential similar functions could be fast traced using in- verted index. Finally, really similar functions could be identified by comparin