Method and system for autonomous malware analysis

A computer-implemented method of automatically determining an interactive GUI element in a graphic user interface (GUI) to be interacted, the method comprising:

• detecting, by a processor, one or more candidate interactive GUI elements in the GUI based on a plurality of algorithms, wherein the plurality of algorithms comprises at least two of:
• an Application Programming Interface (API) based algorithm;
• an entropy based algorithm;
• and
• an Optical Character Recognition (OCR) based algorithm;
• determining, by the processor, a likelihood indicator for each of the one or more candidate interactive GUI elements the likelihood indicator indicating a likelihood that the candidate interactive GUI element associated with the likelihood indicator is the interactive GUI element to be interacted;
• and
• determining, by the processor, the interactive GUI element to be interacted from the one or more candidate interactive GUI elements based on the likelihood indicators;
• wherein the step of detecting, by the processor, one or more candidate interactive GUI elements in the GUI based on a plurality of algorithms comprises:
• extracting, by the processor, text from each of one or more interactive GUI elements in the GUI by using an API for the GUI;
• determining, by the processor, a first algorithm-specific likelihood for each of the one or more interactive GUI elements based on the extracted text;
• and
• determining, by the processor, for each interactive GUI element for which the calculated first algorithm-specific likelihood is greater than a first algorithm-specific threshold, the interactive GUI element as a candidate interactive GUI element;
• wherein the step of determining, by the processor, a likelihood indicator for each of the one or more candidate interactive GUI elements comprises:
• determining, by the processor, the likelihood indicator by weighting the first algorithm-specific likelihood with a first algorithm-specific weight.