Clustering of binary files using architecture-agnostic digests
A target binary file is clustered by reducing the target binary file to its architecture-agnostic functions, which are converted into an input string. The target digest of the input string is calculated and compared to digests of malicious binary files. A cluster having digests of malicious binary files that are similar to the target digest is identified. In response to identifying the cluster, the target binary file is detected to be malicious and of the same malware family as the malicious binary files of the cluster.
1 . A computer-implemented method comprising:
receiving a target binary file;
reducing the target binary file to its architecture-agnostic functions that are called at runtime, wherein the architecture-agnostic functions are not dependent on a processor architecture for which a source code of the target binary file was compiled;
forming the architecture-agnostic functions of the target binary file into an input string;
calculating a target digest of the input string;
identifying a cluster comprising digests of malicious binary files that are similar to the target digest; and
in response to identifying the cluster, detecting the target binary file to be malicious and of a same malware family as the malicious binary files.
2 . The method of claim 1 , further comprising:
in response to detecting that the target binary file is malicious, performing a response action against the target binary file.
3 . The method of claim 2 , wherein the response action includes preventing the target binary file from being executed in a computer.
4 . The method of claim 1 , wherein reducing the target binary file to its architecture-agnostic functions comprises:
extracting symbols of called functions from the target binary file to generate extracted symbols;
removing compiler-specific symbols from the extracted symbols;
removing architecture-specific symbols from the extracted symbols; and
removing symbols that are not related to the called functions from the extracted symbols.
5 . The method of claim 1 , wherein forming the architecture-agnostic functions of the target binary file into the input string comprises:
forming names of the architecture-agnostic functions into a single text string.
6 . The method of claim 5 , wherein the names of the architecture-agnostic functions in the single text string are concatenated and separated by commas.
7 . The method of claim 1 , wherein reducing the target binary file to its architecture-agnostic functions comprises:
extracting destination addresses of called internal function from the target binary file.
8 . The method of claim 7 , wherein forming the architecture-agnostic functions of the target binary file into the input string comprises:
forming the destination addresses into a single text string.
9 . The method of claim 1 , wherein the target digest and the digests of the malicious binary files are locality-sensitive hashes, and identifying the cluster comprises calculating a mathematical distance between the target digest and the digests of the malicious binary files.
10 . The method of claim 1 , wherein the target binary file and the malicious binary files are Executable and Linkable Format (ELF) binary files.
11 . A computer system comprising at least one processor and a memory, the memory storing instructions that, when executed by the at least one processor, cause the computer system to:
receive a target binary file;
reduce the target binary file to its architecture-agnostic functions that are called at runtime, wherein the architecture-agnostic functions are not dependent on a processor architecture for which a source code of the target binary file was compiled;
form the architecture-agnostic functions of the target binary file into an input string;
calculate a target locality-sensitive hash of the input string; and
identify a cluster comprising locality-sensitive hashes of malicious binary files that are within a threshold mathematical distance to the target locality-sensitive hash.
12 . The computer system of claim 11 , wherein the instructions stored in the memory, when executed by the at least one processor, further cause the computer system to:
in response to identifying the cluster, detect the target binary file to be malicious and of a same malware family as the malicious binary files; and
in response to detecting that the target binary file is malicious, perform a response action against the target binary file.
13 . The computer system of claim 11 , wherein the instructions stored in the memory, when executed by the at least one processor, cause the computer system to reduce the target binary file to its architecture-agnostic functions by:
extracting symbols of called functions from the target binary file to generate extracted symbols;
removing compiler-specific symbols from the extracted symbols;
removing architecture-specific symbols from the extracted symbols; and
removing symbols that are not related to the called functions from the extracted symbols.
14 . The computer system of claim 11 , wherein the instructions stored in the memory, when executed by the at least one processor, cause the computer system to form the architecture-agnostic functions of the target binary file into the input string by:
forming names of the architecture-agnostic functions into a single text string.
15 . The computer system of claim 14 , wherein the names of the architecture-agnostic functions in the single text string are concatenated and separated by commas.
16 . The computer system of claim 11 , wherein the instructions stored in the memory, when executed by the at least one processor, cause the computer system to reduce the target binary file to its architecture-agnostic functions by:
extracting destination addresses of called internal functions from the target binary file.
17 . The computer system of claim 16 , wherein the instructions stored in the memory, when executed by the at least one processor, cause the computer system to form the architecture-agnostic functions of the target binary file into the input string by:
forming the destination addresses into a single text string.
18 . The computer system of claim 11 , wherein the target binary file and the malicious binary files are Executable and Linkable Format (ELF) binary files.
19 . A computer-implemented method comprising:
receiving a target Executable and Linkable Format (ELF) binary file;
extracting symbols of called functions from the target ELF binary file to generate extracted symbols;
removing symbols unrelated to the called functions from the extracted symbols;
removing compiler-specific symbols from the extracted symbols;
removing architecture-specific symbols from the extracted symbols;
after removing symbols that are unrelated to the called functions, compiler-specific symbols, and architecture-specific symbols from the extracted symbols, forming remaining symbols in the extracted symbols into an input string;
determining a target locality-sensitive hash of the input string; and
identifying a locality-sensitive hash of a malicious ELF binary file that is within a threshold mathematical distance to the target locality-sensitive hash.
20 . The computer-implemented method of claim 19 , further comprising:
in response to identifying the locality-sensitive hash of the malicious ELF binary file, detecting that the target ELF binary file is malicious.