Method of polymorphic detection
AssigneeAlcatel Lucent
InventorsLori Arline Flynn, Gerald R. Thompson
Life of this patent
Estimating the term…
Abstract
A computer program signature may be determined based on the function flow grammar for a given source code. The function flow grammar may be determined based on reduced control flow graphs generated based on control flow graphs for each function within the source code. A polymorph of a computer program may be detected by comparing the determined computer program signature with computer program signatures, which may be included in a database.
Claims14
A method for detecting a polymorphic instance of a known computer program, the method comprising:
- generating at least one reduced control flow graph by reducing at least one control flow graph, the at least one control flow graph being based on identified functions within a suspect computer program;
- generating a function flow grammar including the identified functions associated with address information from the reduced control flow graph;
- generating a signature of the suspect computer program by ordering the identified functions included in the function flow grammar based on at least one characteristic associated with each function;
- and
- comparing the generated signature with a plurality of signatures for the known computer programs, which are based on a total ordering of functions within each of the known computer programs;
- wherein the generating and comparing steps are executed by a computer processor.
A method for determining a signature for a computer program, the method comprising:
- generating at least one reduced control flow graph by reducing at least one control flow graph, the at least one control flow graph being based on identified functions within the computer program;
- generating a function flow grammar including the identified functions associated with address information from the reduced control flow graph;
- determining a signature of the computer program by ordering the identified functions included in the function flow grammar based on at least one characteristic associated with each function;
- wherein the determining step is executed by a computer processor.
Dependencies are inferred from the claim text.