Application similarity detection

A system for determining whether a first application corresponds to a new version of a second application, comprising:

• a processor;
• and
• a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
• select a program file associated with the first application;
• and
• calculate a hash of the selected program file, and in response to determining that the hash of the selected program file does not match with a plurality of hashes, each being a hash of a corresponding program file associated with one of a plurality of older versions of the second application:
• determine a first program descriptor corresponding to the first application, wherein the first program descriptor comprises metadata fields extracted from the selected program file associated with the first application, and wherein the first program descriptor comprises a plurality of data sections extracted from the selected program file associated with the first application;
• and
• determine that the first application corresponds to a new version of the second application based on a determination that the first program descriptor is similar to a second program descriptor corresponding to one of the plurality of older versions of the second application, wherein determining similarity of the two program descriptors comprises:
• determining that the metadata fields of the first program descriptor are similar to the corresponding metadata fields of the second program descriptor;
• computing a content similarity entropy metric between each data section in the first program descriptor and its corresponding data section in the second program descriptor;
• and
• determining that each data section in the first program descriptor is similar to its corresponding data section in the second program descriptor based on the computed content similarity entropy metrics.

A computer program product for determining whether a first application corresponds to a new version of a second application, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for:

• selecting a program file associated with the first application;
• and
• calculating a hash of the selected program file, and in response to determining that the hash of the selected program file does not match with a plurality of hashes, each being a hash of a corresponding program file associated with one of a plurality of older versions of the second application:
• determining a first program descriptor corresponding to the first application, wherein the first program descriptor comprises metadata fields extracted from the selected program file associated with the first application, and wherein the first program descriptor comprises a plurality of data sections extracted from the selected program file associated with the first application;
• and
• determining that the first application corresponds to a new version of the second application based on a determination that the first program descriptor is similar to a second program descriptor corresponding to one of the plurality of older versions of the second application, wherein determining similarity of the two program descriptors comprises:
• determining that the metadata fields of the first program descriptor are similar to the corresponding metadata fields of the second program descriptor;
• computing a content similarity entropy metric between each data section in the first program descriptor and its corresponding data section in the second program descriptor;
• and
• determining that each data section in the first program descriptor is similar to its corresponding data section in the second program descriptor based on the computed content similarity entropy metrics.

A method of determining whether a first application corresponds to a new version of a second application, comprising:

• identifying a second application having a blacklist policy;
• selecting a program file associated with the first application;
• and
• calculating a hash of the selected program file, and in response to determining that the hash of the selected program file does not match with a plurality of hashes, each being a hash of a corresponding program file associated with one of a plurality of older versions of the second application:
• determining a first program descriptor corresponding to the first application, wherein the first program descriptor comprises metadata fields extracted from the selected program file associated with the first application, and wherein the first program descriptor comprises a plurality of data sections extracted from the selected program file associated with the first application;
• and
• determining that the first application corresponds to a new version of the second application based on a determination that the first program descriptor is similar to a second program descriptor corresponding to one of the plurality of older versions of the second application, wherein determining similarity of the two program descriptors comprises:
• determining that the metadata fields of the first program descriptor are similar to the corresponding metadata fields of the second program descriptor;
• computing a content similarity entropy metric between each data section in the first program descriptor and its corresponding data section in the second program descriptor;
• and
• determining that each data section in the first program descriptor is similar to its corresponding data section in the second program descriptor based on the computed content similarity entropy metrics.

A system for determining whether a first application corresponds to a new version of a second application, comprising:

• a processor;
• and
• a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:
• identify a second application having a blacklist policy;
• select a program file associated with the first application;
• and
• calculate a hash of the selected program file, and in response to determining that the hash of the selected program file does not match with a plurality of hashes, each being a hash of a corresponding program file associated with one of a plurality of older versions of the second application:
• determine a first program descriptor corresponding to the first application, wherein the first program descriptor comprises metadata fields extracted from the selected program file associated with the first application, and wherein the first program descriptor comprises a plurality of data sections extracted from the selected program file associated with the first application;
• and
• determine that the first application corresponds to a new version of the second application based on a determination that the first program descriptor is similar to a second program descriptor corresponding to one of the plurality of older versions of the second application, wherein determining similarity of the two program descriptors comprises:
• determining that the metadata fields of the first program descriptor are similar to the corresponding metadata fields of the second program descriptor;
• computing a content similarity entropy metric between each data section in the first program descriptor and its corresponding data section in the second program descriptor;
• and
• determining that each data section in the first program descriptor is similar to its corresponding data section in the second program descriptor based on the computed content similarity entropy metrics.