Classifying software modules based on fingerprinting code fragments

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device cause the at least one processing device:

• to extract one or more code fragments from a first software module, wherein extracting the one or more code fragments comprises parsing section headers for a plurality of sections of the first software module to identify raw data sections comprising executable code of the first software module;
• to compute fingerprints of the code fragments extracted from the first software module;
• to determine a similarity score based at least in part on distances between the fingerprints of the code fragments extracted from the first software module and fingerprints of one or more code fragments extracted from at least a second software module, the second software module being classified as a given software module type, each of the fingerprints being computed by application of a fuzzy hash function to a given one of the code fragments;
• to classify the first software module as the given software module type based at least in part on the similarity score;
• and
• to modify access by a given client device to the first software module responsive to classifying the first software module as the given software module type;
• wherein the plurality of sections of the first software module are arranged in a designated order, and wherein the similarity score is based at least in part on a number of ordered raw data sections comprising executable code in a first ordered portion of two or more of the raw data sections comprising executable code of the first software module with fingerprints that match a second ordered portion of two or more raw data sections comprising executable code of the second software module.

An apparatus comprising:

• at least one processing device comprising a processor coupled to a memory;
• the at least one processing device being configured:
• to extract one or more code fragments from a first software module, wherein extracting the one or more code fragments comprises parsing section headers for a plurality of sections of the first software module to identify raw data sections comprising executable code of the first software module;
• to compute fingerprints of the code fragments extracted from the first software module;
• to determine a similarity score based at least in part on distances between the fingerprints of the code fragments extracted from the first software module and fingerprints of one or more code fragments extracted from at least a second software module, the second software module being classified as a given software module type, each of the fingerprints being computed by application of a fuzzy hash function to a given one of the code fragments;
• to classify the first software module as the given software module type based at least in part on the similarity score;
• and
• to modify access by a given client device to the first software module responsive to classifying the first software module as the given software module type;
• wherein the plurality of sections of the first software module are arranged in a designated order, and wherein the similarity score is based at least in part on a number of ordered raw data sections comprising executable code in a first ordered portion of two or more of the raw data sections comprising executable code of the first software module with fingerprints that match a second ordered portion of two or more raw data sections comprising executable code of the second software module.