Identification of executable files on the basis of statistical criteria

Abstract

The paper considers methods of identification of executable signatures using statistical criteria. Identification here should be understood as a process of file recognition by establishing its coincidence with a particular program. New ways to creation of executable file signatures are considered. A new approach to identification of elf-files based on the Chi-square and Kolmogorov-Smirnov criteria is offered. Restrictions and conditions of using these criteria are considered. The proposed method can be used to audit data-storage medium.

Keywords

• information security
• data-storage medium audit
• file signature
• file identification
• elf-file
• assembler code
• statistical criterion