Granted Patent B2

US 8,849,836 · App. 13/682,714 · Granted Sep 30, 2014

Abstract

Claims (42)

1. A system for measuring potential similarity of apparently diverse binary objects comprises:

a reporting module which counts number of locations of a non-transitory computer-readable similarity store wherein the non-transitory computer-readable similarity store contains object identifiers of two apparently dissimilar binary objects as a measure of relative similarity;

the non-transitory computer-readable similarity store which contains the object identifiers of any binary object which contains a string which has a pattern corresponding to a location;

a receiving module which deduplicated binary objects which are similarly in any one of name, size, checksum, date, time, source, or destination;

a string selection module which selects comparable strings from each of N binary objects;

a signature determination module which determines a pattern signature for each string selected from the N binary objects;

a similarity store access module which reads from and writes to the location of the non-transitory computer-readable similarity store according to the pattern signature determined from a selected string;

a processor and memory containing executable instructions wherein the processor controls the system to write an object identifier into the location of the non-transitory computer-readable similarity store determined by the pattern signature for each string selected from each of N binary objects, wherein N is an integer number greater than three;

wherein the non-transitory computer-readable similarity store accumulates binary strings and a count of reoccurrence of each of the binary strings in a binary object, wherein the number of binary strings in each binary object is equal to the number of bits or bytes in the binary object minus a length of the binary string plus 1.

2. An apparatus for reporting similarity among N diverse binary objects comprising:

a non-transitory computer-readable similarity store configured to store object identifiers for the N diverse binary objects at locations corresponding to a pattern in a binary string selected from the N diverse binary objects, wherein N is an integer number greater than three;

a signature circuit which transforms a selected binary string to a pattern signature and determines a location of the non-transitory computer-readable similarity store;

a binary string selection circuit which sweeps a sequential range of bits or bytes through a binary object to select a plurality of binary strings from the binary object for the signature circuit to generate pattern signatures; and

a non-transitory data store coupled to the processor to accumulate the binary strings and a count of reoccurrence of each of the binary strings in the binary object, wherein the number of binary strings in the binary object is equal to the number of bits or bytes in the binary object minus a length of the binary string plus 1.

3. The apparatus of claim 2 wherein the signature circuit provides a logical or mathematical transform of the binary string.

4. The apparatus of claim 2 wherein a signature is hash computed on the binary string.

5. The apparatus of claim 2 wherein a signature is the binary string itself.

6. The apparatus of claim 2 further comprising a similarity score reporting circuit configured to determine a number of unique patterns in the latest binary object which are found in another binary object, a number of repetitions of one of the unique patterns as an additional count, and if the number of repetitions in the latest binary object is not equal to the number of repetitions in another file, a similarity score is improved by the lower of the two repetitions.

7. A method for operation of an apparatus to report on similarity of diverse binary objects, the method comprising:

reading a plurality of locations of a non-transitory computer-readable similarity store, wherein the non-transitory computer-readable similarity store contains object identifiers of binary objects which contain a string which has a pattern corresponding to one of the locations;

deduplicating the binary objects which are similarly in any one of name, size, checksum, date, time, source, or destination;

selecting comparable strings from each of the binary objects;

determining a pattern signature for each string selected from the binary objects;

reporting the number of locations which contain object identifiers of two apparently dissimilar binary objects determined by the pattern signature as a measure of their relative similarity to each other; and

accumulating binary strings and a count of reoccurrence of each of the binary strings in one of the binary objects, wherein the number of binary strings in the binary object is equal to the number of bits or bytes in the binary object minus a length of the binary string plus 1.

8. The method of claim 7 further comprising:

writing an object identifier of an Nth dissimilar binary object to a location of the non-transitory computer-readable similarity store corresponding to a pattern signature.

9. The method of claim 8 further comprising:

accessing the location of the non-transitory computer-readable similarity store which has object identifiers for each of the previous N−1 dissimilar binary objects which contain the corresponding pattern in a string selected from the dissimilar binary objects.

10. The method of claim 9 further comprising:

determining at least one digital signature for a binary string in an Nth dissimilar binary object, and

determining a location of similarity store by transforming each digital signature.

11. The method of claim 10 wherein determining a digital signature for at least one binary string in each binary object comprises:

receiving a binary object for pattern matching,

reading the at least one binary string from the binary object,

determining a digital signature H for the binary string, and

selecting a plurality of other binary strings in the binary object, and

determining a digital signature for each binary string.

12. The method of claim 9 further comprising:

reading a list of signatures of the binary strings which comprise a binary object,

retrieving the object identifiers stored at the locations of similarity store corresponding to the list of signatures, and

reporting the identities of binary objects which have a plurality of matching signatures.

Assignments (10)