An effective and intelligent Windows application filtering system using software similarity

As licensed programs are pirated and illegally spread over the Internet, it is necessary to filter illegally distributed or cracked programs. The conventional software filtering systems can prevent unauthorized dissemination of the programs maintained by their databases using an exact matching method where the feature of a suspicious program is the same as that of any program stored in the database. However, the conventional filtering systems have some limitations to deal with cracked or new programs which are not maintained by their database. To address the limitations, we design and implement an efficient and intelligent software filtering system based on software similarity. Our system measures the similarity of the characteristics extracted from an original program and a suspicious one (or, a cracked one) and then determines whether the suspicious program is a cracked version of the copyrighted original program based on the similarity measure. In addition, the proposed system can handle a new program by categorizing it using a machine learning scheme. This scheme helps an unknown program to be identified by narrowing the search space. To demonstrate the effectiveness of the proposed system, we perform a series of experiments on a number of executable programs under Microsoft Windows. The experimental results show that our system has achieved comparable performance.