Method For Measuring Similarity Of Diverse Binary Objects Comprising Bit Patterns
AssigneeBarracuda Networks, Inc.
InventorsZACHARY LEVOW, KEVIN CHANG
Life of this patent
Estimating the term…
Abstract
An apparatus, system, and method for measuring the similarity of binary objects is disclosed. The method determines at least one pattern signature in an Nth binary object, accessing a location in a similarity store which has object identifiers for each of the previous N−1 binary objects which contain the corresponding pattern, and writing the object identifier of the Nth binary object at that same location in the similarity store. Reporting the number of locations in similarity store which contain the object identifiers of two apparently diverse binary objects is a measure of similarity to each other.
Claims14
A system for measuring potential similarity of apparently diverse binary objects comprises:
- a reporting module which counts the number of locations of a non-transitory computer-readable similarity store which contain an object identifier of two apparently dissimilar binary objects as a measure of relative similarity;
- coupled to,
- the non-transitory computer-readable similarity store which contains at its locations, the object identifiers of any binary object which contains a string which has a pattern corresponding to the location;
- coupled to,
- a receiving module which deduplicates binary objects which are essentially similar in any one of name, size, checksum, date, time, source, or destination;
- coupled to,
- a string selection module which selects comparable strings from each of N binary objects;
- coupled to
- a signature determination module which determines a pattern signature for each string selected from the N binary objects;
- coupled to
- a similarity store access module which reads from and writes to a location of similarity store according to the pattern signature determined from a selected string;
- and
- a processor and memory containing executable instructions which controls the system to write an object identifier into a location of similarity store determined by the pattern signature determined for each string selected from each of N binary objects, wherein N is an integer number greater than three.
An apparatus for reporting similarity among N apparently diverse binary objects comprising:
- a non-transitory computer-readable storage configured to store object identifiers for binary objects at locations corresponding to a pattern in a binary string selected from the binary object;
- communicatively coupled to,
- a signature circuit which transforms a selected binary string to a pattern signature and determines a location of similarity store;
- coupled to,
- a binary string selection circuit which sweeps a sequential range of bits or bytes through a binary object to select a plurality of binary strings from each binary object for the signature circuit to generate pattern signatures;
- and
- a processor and memory, wherein N is an integer number greater than three.
A method for operation of an apparatus to report on the similarity of apparently diverse binary objects, the method comprising:
- reading a plurality of locations of a non-transitory computer-readable similarity store;
- and
- reporting the number of locations which contain object identifiers of two apparently dissimilar binary objects as a measure of their relative similarity to each other.
Dependencies are inferred from the claim text.