Investigating the Proximity Metric of Program Assembler Code for Genetic Reverse Engineering

The paper is devoted to solving the problem of assessing the similarity of two programs, which can be used in various areas of information security and cyber forensics, such as malware search, code reuse, authorship verification, and genetic reverse engineering. For this purpose, a corresponding metric is proposed, the value of which is in the range from 0 to 1 (inclusive). The prerequisites for creating the metric are indicated, the idea is described, and an algorithm for calculating it is given, which is then implemented in the Python programming language. The metric is applied to 10 synthetic tests, which shows its overall performance and sensitivity to differences in the assembler code of programs. In addition, a series of experiments is carried out with a direct application of the metric to the assembler code of real mathematical expressions in the $\mathbf{C}$ programming language. Comparison of metric values with the Jaccard Index shows its significant advantage. The importance of using the metric in the authors’ direction of genetic reverse engineering, intended to obtain the source code of a program from its machine or assembler code by using genetic algorithms, is substantiated. The main shortcomings of the research are indicated, their justifications, and ways of elimination are given.