Back to results
US 10,853,457 B2Granted
System and method for program security protection
AssigneeDiDi Research America, LLC
InventorWu Zhou
Life of this patent
Estimating the term…
Abstract
Systems and methods are provided for program security protection. An exemplary method for program security protection may comprise obtaining data packets transceived by a first program, analyzing similarities among the obtained data packets for a plurality of transmissions, and determining a security threat to the first program based on the analyzed similarities.
Claims14
A method for program security protection, comprising:
- obtaining information of Application Programming Interface (API) calls to be executed by a first program via a prelog algorithm, wherein the prelog algorithm is configured to obtain the API call information, the prelog algorithm being executed before the API call is executed;
- analyzing similarities among the obtained API call information;
- and
- determining a security threat to the first program based on the analyzed similarities, wherein:
- the obtained API call information comprises a plurality of API call information strings;
- analyzing the similarities among the obtained API calls comprises determining a number of atomic operations required to change the plurality of API call information strings to a same string;
- a first API call information string S has a length i;
- a second API call information string T has a length j;
- the number of atomic operations required to change the first API call information string S to the second API call information string T is D(Si, Tj);
- and
- determining the number of atomic operations required to change the plurality of API call information strings to the same string comprises:
- (1) in response to determining the ith string character of the first string is the same as the jth string character of the second string, obtaining D(Si−1, Tj−1) as equal to D(Si, Tj);
- (2) in response to determining the ith string character of the first string is different from the jth string character of the second string, obtaining the minimum value of [D(Si−1, Tj−1)+1], [D(Si, Tj−1)+1], and [D(Si−1, Tj)+1] as equal to D(Si, Tj);
- (3) recursively applying steps (1) and (2) to the first and second strings from their last string characters to obtain D(Si, Tj);
- and
- (4) recursively applying steps (1) to (3) to all pairs of API call information strings in the plurality of API call information strings.
13 more elements
A system for program security protection, comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the system to perform a method for security protection, the method comprising:
- obtaining information of Application Programming Interface (API) calls to be executed by a first program via a prelog algorithm, wherein the prelog algorithm is configured to obtain the API call information, the prelog algorithm being executed before the API call is executed;
- analyzing similarities among the obtained API call information;
- and
- determining a security threat to the first program based on the analyzed similarities, wherein:
- the obtained API call information comprises a plurality of API call information strings;
- analyzing the similarities among the obtained API calls comprises determining a number of atomic operations required to change the plurality of API call information strings to a same string;
- a first API call information string S has a length i;
- a second API call information string T has a length j;
- the number of atomic operations required to change the first API call information string S to the second API call information string T is D(Si, Tj);
- and
- determining the number of atomic operations required to change the plurality of API call information strings to the same string comprises:
- (1) in response to determining the ith string character of the first string is the same as the jth string character of the second string, obtaining D(Si−1, Tj−1) as equal to D(Si, Tj);
- (2) in response to determining the ith string character of the first string is different from the jth string character of the second string, obtaining the minimum value of [D(Si−1, Tj−1)+1], [D(Si, Tj−1)+1], and [D(Si−1, Tj)+1] as equal to D(Si, Tj);
- (3) recursively applying steps (1) and (2) to the first and second strings from their last string characters to obtain D(Si, Tj);
- and
- (4) recursively applying steps (1) to (3) to all pairs of API call information strings in the plurality of API call information strings.
16 more elements
Dependencies are inferred from the claim text.