Version-Wide Software Birthmark via Machine Learning

Identifying the credibility of executable files is critical for security an operating system. Modern systems rely on code signing, which uses a default-valid trust model, to identify their publishers. A malware could pass software validation and by using counterfeit code-signing certificates. Although certificates can be revoked CAs, previous research showed that revocation delay takes as long 5.6 months. In this paper, we attempt with multiple-version without relying public key infrastructure (PKI), where new-version file usually developed incrementally based versions. The sharing features among different versions extracted identifying software. Accordingly, present software-birthmark scheme serve our purpose. Our generates cross-version birthmark same proposed binary-classification model machine learning algorithm imported exported function names from different-version files. To evaluate performance version-wide birthmarks, experiments include 138 Windows kernel32.dll 545 firefox.exe . We also use multiple algorithms comparisons. results show effectively derivations these used or suspicious