Abstract: A computer implemented method of estimating a similarity of binary records comprising executable code, comprising converting a first binary record and a second binary record to a first intermediate representation (IR) and a second IR respectively, decomposing each of the first IR and the second IR to a plurality of strands which are partial dependent chains of program instructions, calculating a probability score for each of the plurality of strands of the first IR to have an equivalent counterpart in the second IR by comparing each strand of the first IR to one or more strands of the second IR, adjusting the probability score for each strand according to a significance value calculated for each strand and calculating a similarity score defining a functional similarity between the first IR and the second IR by aggregating the adjusted probability score of the plurality of strands.

Abstract: A computer implemented method of estimating a similarity of binary records comprising executable code, comprising converting a first binary record and a second binary record to a first intermediate representation (IR) and a second IR respectively, decomposing each of the first IR and the second IR to a plurality of strands which are partial dependent chains of program instructions, calculating a probability score for each of the plurality of strands of the first IR to have an equivalent counterpart in the second IR by comparing each strand of the first IR to one or more strands of the second IR, adjusting the probability score for each strand according to a significance value calculated for each strand and calculating a similarity score defining a functional similarity between the first IR and the second IR by aggregating the adjusted probability score of the plurality of strands.

Abstract: A computer implemented method of estimating a similarity of binary records comprising executable code, comprising converting a first binary record and a second binary record to a first intermediate representation (IR) and a second IR respectively, decomposing each of the first IR and the second IR to a plurality of strands which are partial dependent chains of program instructions, calculating a probability score for each of the plurality of strands of the first IR to have an equivalent counterpart in the second IR by comparing each strand of the first IR to one or more strands of the second IR, adjusting the probability score for each strand according to a significance value calculated for each strand and calculating a similarity score defining a functional similarity between the first IR and the second IR by aggregating the adjusted probability score of the plurality of strands.

Abstract: A computer implemented method of estimating a similarity of binary records comprising executable code, comprising converting a first binary record and a second binary record to a first intermediate representation (IR) and a second IR respectively, decomposing each of the first IR and the second IR to a plurality of strands which are partial dependent chains of program instructions, calculating a probability score for each of the plurality of strands of the first IR to have an equivalent counterpart in the second IR by comparing each strand of the first IR to one or more strands of the second IR, adjusting the probability score for each strand according to a significance value calculated for each strand and calculating a similarity score defining a functional similarity between the first IR and the second IR by aggregating the adjusted probability score of the plurality of strands.