Irrelevant Code Identification
AssigneeCrowdStrike, Inc.
InventorJason Geffner
Life of this patent
Estimating the term…
Abstract
The techniques described herein identify, and/or distinguish between, legitimate code and/or irrelevant code in programs so that an analyst does not have to spend additional time sifting through and/or considering the irrelevant code when viewing the code of the program. Therefore, the analyst can be more efficient when determining a type of a program (e.g., malware) and/or when determining the actions of the program. For instance, a security researcher may be tasked with identifying the malware and/or determining the harmful or deceptive actions the malware executes on a computer (e.g., deletion of a file, the targeting of sensitive information such as social security numbers or credit card numbers, etc.).
Claims20
A method comprising:
- identifying one or more legitimate code elements of an executable file based at least in part on one or more assumptions;
- identifying one or more code elements that interact with the one or more legitimate code elements;
- labeling the one or more code elements as legitimate;
- labeling one or more other code elements that are not legitimate as irrelevant code elements;
- and
- removing the irrelevant code elements from the executable file.
A non-transitory computer-readable media comprising instructions that, when executed by a processor, perform operations comprising:
- identifying one or more legitimate code elements of at least a portion of a computer program;
- identifying one or more irrelevant code elements of the at least the portion of the computer program;
- and
- outputting a visual representation of the at least the portion of the computer program, the visual representation having the one or more irrelevant code elements removed from view or the visual representation distinguishing between the one or more legitimate code elements and the one or more irrelevant code elements.
A device comprising:
- one or more processors;
- one or more memories;
- a deobfuscation module, stored on the one or more memories and operable by the one or more processors, to identify at least one irrelevant code element from a plurality of code elements of an executable file to remove the at least one irrelevant code element from the executable file.
Dependencies are inferred from the claim text.