Detection of Similar Functions Through the Use of Dominator Information

Abstract

The detection of code clones is an important technique for finding malware and malicious code. Many existing methods work on source code to detect code clones. Recent work in this area has started to focus on the analysis of compiled code to find malicious code. We introduce a new method to detect code clones using Java bytecode and control flow information from dominator trees. A prototype implementation was developed and compared with the state-of-the-art clone detector NiCad to evaluate the basic functionality of the method. First experiments have shown that the method can reliably find Type 1 and Type 2 clones and even find additional clones.