Back to results
US 8,997,256 B1Granted
Systems and methods for detecting copied computer code using fingerprints
AssigneeTerbium Labs LLC
InventorsDaniel Jordan Rogers, Michael Alan Moore
Life of this patent
Estimating the term…
Abstract
Systems and methods of detecting copying of computer code or portions of computer code involve generating unique fingerprints from compiled computer binaries. The unique fingerprints are simplified representations of the compiled computer binaries and are compared with each other to identify similarities between the compiled computer binaries. Copying can be detected when there are sufficient similarities between at least portions of two compiled computer binaries.
Claims26
A method comprising:
- receiving, by a computer, a first compiled computer binary;
- generating, by the computer, a first fingerprint of the first compiled computer binary;
- receiving, by the computer, a second compiled computer binary;
- generating, by the computer, a second fingerprint of the second compiled computer binary;
- comparing, by the computer, the first fingerprint of the first compiled computer binary with the second fingerprint of the second compiled computer binary;
- and
- determining, by the computer, whether at least some of the first compiled computer binary is present in the second compiled computer binary based on the comparison,
- wherein the generation of the first fingerprint of the first compiled computer binary comprises
- generating, by the computer, a call graph using the first compiled computer binary;
- generating, by the computer, a control flow graph for each of a plurality of functions in the call graph;
- selecting, by the computer, one of the plurality of functions;
- calculating, by the computer for the selected one of the plurality of functions, a leading Eigenvector of an adjacency matrix of the selected function's control flow graph;
- generating, by the computer for the selected one of the plurality of functions, an edge-connected path starting from a node corresponding to a largest element in the leading Eigenvector of the adjacency matrix and appending connected nodes corresponding to successively smaller elements of the leading Eigenvector;
- and
- calculating, by the computer for the selected one of the plurality of functions, unique spectra of the control flow graph for the selected function using the generated edge-connected path.
12 more elements
A method comprising:
- receiving, by a computer, a first compiled computer binary;
- generating, by the computer, a first fingerprint of the first compiled computer binary;
- receiving, by the computer, a second compiled computer binary;
- generating, by the computer, a second fingerprint of the second compiled computer binary;
- comparing, by the computer, the first fingerprint of the first compiled computer binary with the second fingerprint of the second compiled computer binary;
- and
- determining, by the computer, whether at least some of the first compiled computer binary is present in the second compiled computer binary based on the comparison,
- wherein the comparison of the first fingerprint of the first compiled computer binary with the second fingerprint of the second compiled computer binary comprises
- computing, by the computer, distances between each pair of possible functions of the first and second compiled computer binaries;
- selecting, by the computer, a subset of the pairs of possible functions;
- and
- calculating, by the computer, a cross-correlation of unique spectra for each pair of functions of the subset of pairs of possible functions,
- wherein the unique spectra are count block size, in-degree, and out-degree along the edge-connected path,
- wherein the cross-correlation of unique spectra produces, for each pair of functions of the subset of pairs of possible function
- a block size correlation coefficient;
- an in-degree correlation coefficient;
- and
- an out-degree correlation coefficient.
15 more elements
A system comprising:
- an input configured to receive a first and second compiled computer binary;
- a microprocessor coupled to the input to receive the first and second compiled computer binaries, wherein the microprocessor is configured to
- generate a first fingerprint of the first compiled computer binary;
- generate a second fingerprint of the second compiled computer binary;
- compare the first fingerprint of the first compiled computer binary with the second fingerprint of the second compiled computer binary;
- and
- determine whether at least some of the first compiled computer binary is present in the second compiled computer binary based on the comparison;
- and
- an output coupled to the microprocessor, wherein the output is configured to output an indication of whether at least some of the first compiled computer binary is present in the second compiled computer binary,
- wherein the configuration of the microprocessor to generate the first fingerprint of the first compiled computer binary involves the microprocessor being configured to
- generate a call graph using the first compiled computer binary;
- generate a control flow graph for each of a plurality of functions in the call graph;
- select one of the plurality of functions;
- calculate, for the selected one of the plurality of functions, a leading Eigenvector of an adjacency matrix of the selected function's control flow graph;
- generate, for the selected one of the plurality of functions, an edge-connected path starting from a node corresponding to a largest element in the leading Eigenvector of the adjacency matrix and appending connected nodes corresponding to successively smaller elements of the leading Eigenvector;
- and
- calculate, for the selected one of the plurality of functions, unique spectra of the control flow graph for the selected function using the generated edge-connected path.
14 more elements
A system comprising:
- an input configured to receive a first and second compiled computer binary;
- a microprocessor coupled to the input to receive the first and second compiled computer binaries, wherein the microprocessor is configured to
- generate a first fingerprint of the first compiled computer binary;
- generate a second fingerprint of the second compiled computer binary;
- compare the first fingerprint of the first compiled computer binary with the second fingerprint of the second compiled computer binary;
- and
- determine whether at least some of the first compiled computer binary is resent in the second compiled computer binary based on the comparison;
- and
- an output coupled to the microprocessor, wherein the output is configured to output an indication of whether at least some of the first compiled computer binary is present in the second compiled computer binary,
- wherein the configuration of the microprocessor to compare the first fingerprint of the first compiled computer binary with the second fingerprint of the second compiled computer binary involves the microprocessor being configured to
- compute distances between each pair of possible functions of the first and second compiled computer binaries;
- select a subset of the pairs of possible functions;
- and
- calculate a cross-correlation of unique spectra for each pair of functions of the subset of pairs of possible functions,
- wherein the unique spectra are count block size, in-degree, and out-degree along the edge-connected path,
- wherein the cross-correlation of unique spectra produces, for each pair of functions of the subset of pairs of possible function
- a block size correlation coefficient;
- an in-degree correlation coefficient;
- and
- an out-degree correlation coefficient.
17 more elements
Dependencies are inferred from the claim text.