Package com.tonic.analysis.fingerprint.features

Class Level2Features

java.lang.Object

com.tonic.analysis.fingerprint.features.Level2Features

All Implemented Interfaces:

FeatureVector

public class Level2Features
extends Object
implements FeatureVector

Detailed fingerprint features: opcode-category bigrams, CFG edge and terminator histograms, and dominance depth.

Constructor Summary

Constructors

Constructor	Description
Level2Features(Map<String,Integer> opcodeNgrams, Map<String,Integer> cfgEdgeTypes, int dominanceDepth, Map<String,Integer> terminatorTypes, Map<String,Integer> instructionTypes)	Creates a level-2 feature set, normalizing every histogram to per-mille proportions.

Method Summary

Modifier and Type	Method	Description
byte[]	computeHash()	Digests every extracted feature into a hash usable for equality and lookup.
Map<String,Integer>	getCfgEdgeTypeDistribution()
int	getDominanceTreeDepth()
Map<String,Integer>	getInstructionTypeHistogram()
static String	getOpcodeCategory(int opcode)	Maps an opcode onto a coarse category name such as const, load, math, or invoke.
Map<String,Integer>	getOpcodeNgramHistogram()
Map<String,Integer>	getTerminatorTypeHistogram()
boolean	isValid()
double	similarity(Level2Features other)	Scores similarity to another level-2 feature set from histogram overlaps and dominance-depth closeness.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Level2Features

public Level2Features(Map<String,Integer> opcodeNgrams,
                      Map<String,Integer> cfgEdgeTypes,
                      int dominanceDepth,
                      Map<String,Integer> terminatorTypes,
                      Map<String,Integer> instructionTypes)

Creates a level-2 feature set, normalizing every histogram to per-mille proportions.

Parameters:

opcodeNgrams - counts per opcode-category bigram

cfgEdgeTypes - counts per CFG edge type

dominanceDepth - the dominance tree depth

terminatorTypes - counts per block-terminator type

instructionTypes - counts per instruction category

Method Detail

getOpcodeCategory

public static String getOpcodeCategory(int opcode)

Maps an opcode onto a coarse category name such as const, load, math, or invoke.

Parameters:

opcode - the opcode to classify

Returns:

the category name, "other" if unrecognized

computeHash

public byte[] computeHash()

Description copied from interface: FeatureVector

Digests every extracted feature into a hash usable for equality and lookup.

Specified by:

computeHash in interface FeatureVector

Returns:

the digest bytes

isValid

public boolean isValid()

Specified by:

isValid in interface FeatureVector

Returns:

true if extraction produced features that can be matched against

similarity

public double similarity(Level2Features other)

Scores similarity to another level-2 feature set from histogram overlaps and dominance-depth closeness.

Parameters:

other - the feature set to compare against

Returns:

a score in [0, 1], 0 if other is null

getOpcodeNgramHistogram

public Map<String,Integer> getOpcodeNgramHistogram()

Returns:

an unmodifiable view of the normalized opcode-category bigram histogram

getCfgEdgeTypeDistribution

public Map<String,Integer> getCfgEdgeTypeDistribution()

Returns:

an unmodifiable view of the normalized CFG edge-type distribution

getDominanceTreeDepth

public int getDominanceTreeDepth()

Returns:

the dominance tree depth

getTerminatorTypeHistogram

public Map<String,Integer> getTerminatorTypeHistogram()

Returns:

an unmodifiable view of the normalized terminator-type histogram

getInstructionTypeHistogram

public Map<String,Integer> getInstructionTypeHistogram()

Returns:

an unmodifiable view of the normalized instruction-category histogram