基于相似性的匹配应对恶意软件多样性
Similarity-based matching meets Malware Diversity
AI总结：
本文提出利用相似性度量检测恶意软件，通过软件多样化技术生成功能等价但不同的二进制文件，验证相似性度量在多样化二进制中匹配率低。
摘要：
相似性度量，例如反病毒产品使用的签名，是检测给定二进制是否为恶意软件的主要技术。该方法的假设是所有恶意软件实例（甚至恶意软件家族）彼此相似。软件多样化是一种概率技术，利用代码和数据随机化以及目标指令集的表达性来生成大量功能等价但不同的二进制文件。恶意软件多样性建立在软件多样化基础上，确保同一恶意软件的多样化实例在根据一组相似性度量下具有低相似性。一个基于LLVM的原型实现对二进制的代码和数据进行多样化，我们的评估显示，在由同一源代码生成的多样化二进制池中，基于相似性的签名只匹配一两个实例。
英文摘要：
Similarity metrics, e.g., signatures as used by anti-virus products, are the dominant technique to detect if a given binary is malware. The underlying assumption of this approach is that all instances of a malware (or even malware family) will be similar to each other. Software diversification is a probabilistic technique that uses code and data randomization and expressiveness in the target instruction set to generate large amounts of functionally equivalent but different binaries. Malware diversity builds on software diversity and ensures that any two diversified instances of the same malware have low similarity (according to a set of similarity metrics). An LLVM-based prototype implementation diversifies both code and data of binaries and our evaluation shows that signatures based on similarity only match one or few instances in a pool of diversified binaries generated from the same source code.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
