Detecting anomalous binaries by measuring drift from their own version history

Frequency masking on embedded binary strings Can a binary be evaluated against the statistical structure of its own version history? Verifying the integrity of distributed binaries usually depends on reproducible builds or vendor signatures. This post shows a simple experiment using nine versions of Alpine’s apk binary. In practice, both assumptions often fail. Many projects do not provide…