Detecting similarities in Java sources from bytecodes
AssigneeLucent Technologies Inc.
InventorsBrenda Sue Baker, Udi Manber
Life of this patent
Estimating the term…
Abstract
A technique for detecting similarities in large sets of binary code files, e.g., bytecode files, without requiring access or knowledge of the actual source code itself. In accordance with the technique, bytecode files are disassembled and preprocessed using positional encoding to prepare the disassembled bytecode files for use in conjunction with similarity detection tools.
Claims15
A method of detecting similarities between a plurality of bytecode files, the method comprising:
- disassembling each bytecode file of the plurality of bytecode files to form a plurality of disassembled bytecode files;
- applying a lexical analyzer to at least one disassembled bytecode file, the applying the lexical analyzer operation further comprising:
- separating at least one disassembled bytecode file into a plurality of parameter tokens and a plurality of non-parameter tokens;
- and
- computing a offset for at least one parameter token of the plurality of parameter tokens;
- positionally encoding each disassembled bytecode file of the plurality of disassembled bytecode files;
- and
- detecting similarities between particular ones of the bytecode files as a function of a comparison between the encoded disassembled bytecode files.
A method of detecting similarities between a plurality of bytecode files, the method comprising:
- disassembling each bytecode file of the plurality of bytecode files to form a plurality of disassembled bytecode files, wherein each disassembled bytecode file includes a plurality of indexes, at least one index of the plurality of indexes being linked with a constant pool, and at least another one index of the plurality of indexes being linked with a local variable table;
- applying a lexical analyzer to at least one disassembled bytecode file;
- positionally encoding each disassembled bytecode file of the plurality of disassembled bytecode files;
- and
- detecting similarities between particular ones of the bytecode files as a function of a comparison between the encoded disassembled bytecode files.
A machine-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions that, when executed by a machine, cause the machine to perform a method of detecting similarities between a plurality of bytecode files by disassembling each bytecode file of the plurality of bytecode files to form a plurality of disassembled bytecode files, applying a lexical analyzer to at least one disassembled bytecode file, positionally encoding each disassembled bytecode file of the plurality of disassembled bytecode files, and detecting similarities between particular ones of the bytecode files as a function of a comparison between the encoded disassembled bytecode files, wherein the positionally encoding is performed in a manner in which like parameters contained within a particular disassembled bytecode file are labeled to identify the like parameters' positional relationships within the particular disassembled bytecode file, and wherein each disassembled bytecode file includes a plurality of indexes, at least one index of the plurality of indexes being linked with a constant pool, and at least another one index of the plurality of indexes being linked with a local variable table.
An apparatus for detecting similarities in a plurality of binary code files, the apparatus comprising:
- means for disassembling each binary code file of the plurality of binary code files to form a plurality of disassembled binary code files, wherein each disassembled binary code file includes a plurality of indexes, at least one index of the plurality of indexes being linked with a constant pool, and at least another one index of the plurality of indexes being linked with a local variable table;
- means for positionally encoding particular ones of the disassembled binary code files;
- and
- means for detecting similarities between particular ones of the binary code files as a function of a comparison between the encoded disassembled binary code files.
Dependencies are inferred from the claim text.