A Comparative Study on the Accuracy and the Speed of Static and Dynamic Program Classifiers
Research output: Contribution to book/Conference proceedings/Anthology/Report › Conference contribution › Contributed › peer-review
Contributors
Abstract
Classifying programs based on their tasks is essential in fields such as plagiarism detection, malware analysis, and software auditing. Traditionally, two classification approaches exist: static classifiers analyze program syntax, while dynamic classifiers observe their execution. Although dynamic analysis is regarded as more precise, it is often considered impractical due to high overhead, leading the research community to largely dismiss it. In this paper, we revisit this perception by comparing static and dynamic analyses using the same classification representation: opcode histograms. We show that dynamic histograms-generated from instructions actually executed-are only marginally (4-5%) more accurate than static histograms in non-adversarial settings. However, if an adversary is allowed to obfuscate programs, the accuracy of the dynamic classifier is twice higher than the static one, due to its ability to avoid observing dead-code. Obtaining dynamic histograms with a state-of-the-art Valgrind-based tool incurs an 85x slowdown; however, once we account for the time to produce the representations for static analysis of executables, the overall slowdown reduces to 4x: a result significantly lower than previously reported in the literature.
Details
| Original language | English |
|---|---|
| Title of host publication | CC 2025 - Proceedings of the 34th ACM SIGPLAN International Conference on Compiler Construction |
| Editors | Daniel Kluss, Sara Achour, Jens Palsberg |
| Publisher | Association for Computing Machinery, Inc |
| Pages | 13-24 |
| Number of pages | 12 |
| ISBN (electronic) | 9798400714078 |
| Publication status | Published - 25 Feb 2025 |
| Peer-reviewed | Yes |
Conference
| Title | 34th ACM SIGPLAN International Conference on Compiler Construction |
|---|---|
| Abbreviated title | CC 2025 |
| Conference number | 34 |
| Description | co-located with CGO, PPoPP and HPCA |
| Duration | 1 - 2 March 2025 |
| Location | Westin Las Vegas |
| City | Las Vegas |
| Country | United States of America |
External IDs
| ORCID | /0000-0002-5007-445X/work/190572579 |
|---|
Keywords
ASJC Scopus subject areas
Keywords
- Binary Diffing, Classification, Valgrind