Systems and methods for efficiently matching files

A system for efficiently matching files, the system comprising:

• an analysis module, stored in memory, that analyzes a file to identify a set of functions within the file and relationships between functions within the set of functions;
• a creation module, stored in memory, that creates a set of representations for the set of functions by, for each function within the set of functions;
• combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function;
• and
• combining a representation of a total number of instructions within a given function with a representation of the total number of instructions within each function identified as having the relationship to the given function;
• a comparison module, stored in memory, that compares a subset of the set of representations of the set of functions with a subset of a set of representations of an additional set of functions identified within an additional file;
• a determination module, stored in memory, that determines, based on comparing the subset of the set of representations of the set of functions with the subset of the set of representations of the additional set of functions identified within the additional file, that the file matches the additional file;
• and
• at least one physical processor configured to execute the analysis module, the creation module, the comparison module, and the determination module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• analyze a file to identify a set of functions within the file and relationships between functions within the set of functions;
• create a set of representations for the set of functions by, for each function within the set of functions;
• combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function;
• and
• combining a representation of a total number of instructions within a given function with a representation of the total number of instructions within each function identified as having the relationship to the given function;
• compare a subset of the set of representations of the set of functions with a subset of a set of representations of an additional set of functions identified within an additional file;
• and
• determine, based on comparing the subset of the set of representations of the set of functions with the subset of the set of representations of the additional set of functions identified within the additional file, that the file matches the additional file.