SIMILARITY EVALUATING DEVICE, SIMILARITY EVALUATING SYSTEM, SIMILARITY EVALUATING METHOD, AND SIMILARITY EVALUATING PROGRAM

摘要

PROBLEM TO BE SOLVED: To accurately evaluate similarities of two or more compressed or encrypted executable-form files.SOLUTION: When a processing target file is expanded onto a memory, a similarity evaluating device 3 generates memory image binary files of the processing target file, and divides each of a comparison source file and a comparison destination file among the generated binary files in similarity evaluation into a plurality of sections to generate a divided comparison source file and a divided comparison destination file. The similarity evaluating device 3 then generates a comparison source section feature quantity and a comparison destination section feature quantity indicating a prescribed entropy value per section of the divided comparison source file and the divided comparison destination file, corrects each of the comparison source section feature quantity and comparison destination section feature quantity by DP matching, and evaluates similarities by comparing the corrected comparison source section feature quantity and comparison destination section feature quantity per section.SELECTED DRAWING: Figure 2