Systems and methods for detecting copied computer code using fingerprints

摘要

Systems and methods of detecting copying of computer code or portions of computer code involve generating unique fingerprints from compiled computer binaries. The unique fingerprints are simplified representations of functions in the compiled computer binaries and are compared with each other to identify similarities between functions in the respective compiled computer binaries. Copying can be detected when there are sufficient similarities between fingerprints of two functions.

主权项

1. A method comprising:
receiving, by a computer, a first compiled computer binary; generating, by the computer, a first fingerprint of a first function of the first compiled computer binary by
generating a block rank score for each block in the first function;generating a path of blocks of the first function based on the block rank score of each block;generating the first fingerprint using the generated path of blocks of the first function; receiving, by the computer, a second compiled computer binary; generating, by the computer, a second fingerprint of a second function of the second compiled computer binary by
generating a block rank score for each block in the second function;generating a path of blocks of the second function based on the block rank score of each block;generating the second fingerprint using the generated path of blocks of the second function; comparing, by the computer, the first fingerprint of the first function with the second fingerprint of the second function; and determining, by the computer, whether the second function includes at least some of code from the first function based on the comparison, wherein the generation of a block rank score for each block in the first and second functions involves reversing all edges in a control flow graph for the first and second functions and assigning a block rank score to each block based on block rank scores of blocks having a forward path to the each block.