Authors: Flake, Halvar
Title: Structural Comparison of Executable Objects
Language (ISO): en
Abstract: A method to heuristically construct an isomorphism between the sets of functions in two similar but differing versions of the same executable file is presented. Such an isomorphism has multiple practical applications, specifically the ability to detect programmatic changes between the two executable versions. Moreover, information (function names) which is available for one of the two versions can also be made available for the other . A framework implementing the described methods is presented, along with empirical data about its performance when used to analyze patches to recent security vulnerabilities. As a more practical example, a security update which fixes a critical vulnerability in an H.323 parsing component is analyzed, the relevant vulnerability extracted and the implications of the vulnerability and the fix discussed.
Subject Headings: Vulnerability Assessment
Issue Date: 2004-07
Provenance: Gesellschaft für Informatik
Citation: Flake, Halvar: Structural Comparison of Executable Objects. In Flegel, U.; Meier, M. (Eds.): Proc. of the International GI Workshop on Detection of Intrusions and Malware & Vulnerability Assessment, number P-46 in Lecture Notes in Informatics, pp. 161-174 , Dortmund, Germany, July 2004, Köllen Verlag; ISBN 3-88579-365-X.
Is part of: DIMVA 2004, July 6-7, Dortmund, Germany
Appears in Collections:Papers

Files in This Item:
File Description SizeFormat 
DIMVA2004-Flake.pdf381.89 kBAdobe PDFView/Open

This item is protected by original copyright

Items in Eldorado are protected by copyright, with all rights reserved, unless otherwise indicated.