Similarity-based matching meets Malware Diversity

Abstract: Similarity metrics, e.g., signatures as used by anti-virus products, are the dominant tech-nique to detect if a given binary is malware. The underlying assumption of this approach is that all instances of a malware (or even malware family) will be similar to each other. Software diversification is a probabilistic technique that uses code and data randomization and expres-siveness in the target instruction set to generate large amounts of functionally equivalent but different bina-ries. Malware diversity builds on software diversity and ensures that any two diversified instances of the same malware have low similarity (according to a set of similarity metrics). An LLVM-based proto-type implementation diversifies both code and data of binaries and our evaluation shows that signatures based on similarity only match one or few instances in a pool of diversified binaries generated from the same source code.