Clustering of binary files using architecture-agnostic digests
AssigneeTrend Micro Incorporated
InventorsFernando Vinicius Merces Pinheiro, Joey Nojas Costoya
Life of this patent
Estimating the term…
Abstract
A target binary file is clustered by reducing the target binary file to its architecture-agnostic functions, which are converted into an input string. The target digest of the input string is calculated and compared to digests of malicious binary files. A cluster having digests of malicious binary files that are similar to the target digest is identified. In response to identifying the cluster, the target binary file is detected to be malicious and of the same malware family as the malicious binary files of the cluster.
Claims20
A computer-implemented method comprising:
- receiving a target binary file;
- reducing the target binary file to its architecture-agnostic functions that are called at runtime, wherein the architecture-agnostic functions are not dependent on a processor architecture for which a source code of the target binary file was compiled;
- forming the architecture-agnostic functions of the target binary file into an input string;
- calculating a target digest of the input string;
- identifying a cluster comprising digests of malicious binary files that are similar to the target digest;
- and
- in response to identifying the cluster, detecting the target binary file to be malicious and of a same malware family as the malicious binary files.
A computer system comprising at least one processor and a memory, the memory storing instructions that, when executed by the at least one processor, cause the computer system to:
- receive a target binary file;
- reduce the target binary file to its architecture-agnostic functions that are called at runtime, wherein the architecture-agnostic functions are not dependent on a processor architecture for which a source code of the target binary file was compiled;
- form the architecture-agnostic functions of the target binary file into an input string;
- calculate a target locality-sensitive hash of the input string;
- and
- identify a cluster comprising locality-sensitive hashes of malicious binary files that are within a threshold mathematical distance to the target locality-sensitive hash.
A computer-implemented method comprising:
- receiving a target Executable and Linkable Format (ELF) binary file;
- extracting symbols of called functions from the target ELF binary file to generate extracted symbols;
- removing symbols unrelated to the called functions from the extracted symbols;
- removing compiler-specific symbols from the extracted symbols;
- removing architecture-specific symbols from the extracted symbols;
- after removing symbols that are unrelated to the called functions, compiler-specific symbols, and architecture-specific symbols from the extracted symbols, forming remaining symbols in the extracted symbols into an input string;
- determining a target locality-sensitive hash of the input string;
- and
- identifying a locality-sensitive hash of a malicious ELF binary file that is within a threshold mathematical distance to the target locality-sensitive hash.
Dependencies are inferred from the claim text.