Abstract: An example method for determining a software classification is provided. The example method may include determining a plurality of substream boundaries including a first substream boundary within a representation of a software binary, and segmenting the representation of the software binary into a plurality of substreams. The example method may further include generating a first count string for a first substream based on operational class token counts in a tokenization of the first substream, where the tokenization of the first substream may be based on a mapping of commands within the first substream to operational classes. The example method may further include performing a first count string comparison with a reference database to determine a first count string match, where the first count string comparison being based on the first count string, and classifying the software binary based on the first count string match.

Abstract: An example method for determining a software classification is provided. The example method may include determining a plurality of substream boundaries including a first substream boundary within a representation of a software binary, and segmenting the representation of the software binary into a plurality of substreams. The example method may further include generating a first count string for a first substream based on operational class token counts in a tokenization of the first substream, where the tokenization of the first substream may be based on a mapping of commands within the first substream to operational classes. The example method may further include performing a first count string comparison with a reference database to determine a first count string match, where the first count string comparison being based on the first count string, and classifying the software binary based on the first count string match.

Abstract: An apparatus for identifying related code variants may include processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints, and preparing at least one report based on the similarity measure.

Abstract: An apparatus for identifying related code variants may include processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints, and preparing at least one report based on the similarity measure.