First Byte: Force-Based Clustering of Filtered Block N-Grams to Detect Code Reuse in Malicious Software

Detecting code reuse in malicious software is compli-cated by the lack of source code. The same circumstance that makes code reuse detection in malicious software desir-able, that is, the limited availability of original source code, also contributes to the difficulty of detecting code reuse. In this paper, we propose a method for detecting code reuse in software, specifically malicious software, that moves be-yond the limitations of targeting variant detection (catego-rization of families). This method expands n-gram analysis to target basic blocks extracted from compiled code vice en-tire text sections. It also targets individual relationships be-tween basic blocks found in localized code reuse, while pre-serving the ability to detect variants and families of variants found with generalized code reuse. We demonstrate the lim