The Johns Hopkins University

Jonathan D Cohen

C Durward McDonell, Iii

Laura J Glendenning

Margaret F Lospinuso

Ryan W Gardner

Nathan S Reller

Sakunthala Harshavardhana

David P Silberberg

Robert T Hider

Dennis S Patrone

Benjamin R Salazar

David M Patrone

A method of determining matching between at least a first sample comprising a sequence of tokens A and a second sample comprising a sequence of tokens B may include, for monotonically decreasing values of n, performing operations including recording a subset SA of n-grams of A in a hash table LA, such that a value of each n-gram determines an index in LA and a location of each respective n-gram in A is recorded as the value in LA, recording a subset SB of n-grams of B in a hash table LB, such that a value of each n-gram determines an index in LB and a location of each respective n-gram in B is recorded as the value in LB, for each location L that is occupied in both LA and LB, examining a region in A centered on LA(L) and a region in B centered on LB(L), and reporting a largest matching region aligning LA(L) with LB(L) that does not include already-matched tokens in A or B and marking the largest matching region as matched.

Apparatus and method for aligning token sequences with block permutations

A method for identifying similarity between query samples and stored samples in an efficiently maintained reference library may include receiving a binary query sample and processing the binary query sample via operations including producing a query sample fingerprint from the binary query sample, scoring the query sample fingerprint with each previously stored fingerprint in the reference library to produce a matching score, and for each previously stored fingerprint for which the matching score meets or exceeds a predetermined threshold, reporting a corresponding reference sample unique identifier associated with the previously stored fingerprint and the matching score. Each previously stored fingerprint in the reference library has been determined, prior to storage, as not being duplicative of another fingerprint in the reference library.

Apparatus and method for efficient identification of code similarity

An apparatus for identifying related code variants or text samples includes processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, generating token sequence n-grams of the fingerprints, hashing the n-grams, partitioning samples by length to compare selected samples based on length, and identifying similarity via dynamic decimation of token sequence n-grams.

Apparatus and method for identifying similarity via dynamic decimation of token sequence N-grams

A method for identifying similarity between query samples and stored samples in an efficiently maintained reference library may include receiving a first threshold and a second threshold, receiving a plurality of binary reference samples, and processing each reference sample of the plurality of reference samples. The processing may include operations of assigning each reference sample a respective unique identifier, producing a reference sample fingerprint for each reference sample, and registering each respective unique identifier to reference sample fingerprint pair in a reference library. The registering may include scoring the reference sample fingerprint with each previously stored fingerprint in the reference library to produce a first matching score, if the first matching score meets or exceeds the first threshold for a previously stored fingerprint, determining the reference sample fingerprint to be a duplicate of the previously stored fingerprint and recording only a unique identifier associated with the reference sample fingerprint in the reference library where the unique identifier is marked as a duplicate of the previously stored fingerprint, and otherwise, if the first matching score is less than the first threshold, storing a corresponding reference sample unique identifier to reference sample fingerprint pair in the reference library. The method may further include receiving a binary query sample and processing the binary query sample via operations including producing a query sample fingerprint from the binary query sample, scoring the query sample fingerprint with each previously stored fingerprint in the reference library to produce a second matching score, and for each previously stored fingerprint for which the second matching score meets or exceeds the second threshold, reporting a corresponding reference sample unique identifier associated with the previously stored fingerprint and the second matching score.

Apparatus and method for identifying similarity via dynamic decimation of token sequence n-grams

An apparatus for identifying related code variants may include processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints, and preparing at least one report based on the similarity measure.

Growing community of inventors

Glenwood, MD, United States of America

Jonathan D Cohen