Software Homology Detection With Software Motifs Based on Function-Call Graph

Software homology plays an important role in intellectual property protection, malware analysis, and network attack traceback. Among many methods proposed by researchers, the structure-based method has been proved to have better detection and anti-obfuscation capabilities, but it is inefficiency on space-time complexity and difficult to be applied to large-scale software homology analysis. In this paper, we propose a parallel method to extract function call graph from source codes, and a new software structure information comparison algorithm. The approach transforms function call graph into the corresponding motifs as the features of the software, and calculates homology score by the algorithm which is quick and accurate for large-scale software based on software motifs. According to experiments on large-scale source codes, binary executable files and obfuscated software, the accuracy of homology detection is 90.00% for non-obfuscated software and 80.00% for obfuscated software.