Back to results
US 9,438,620 B2Granted
Control flow graph representation and classification
AssigneeMcAfee, Inc.
InventorsErdem Aktas, Rachit Mathur
Life of this patent
Estimating the term…
Abstract
A software sample is identified that includes code and a control flow graph is generated for each of a plurality of functions included in the sample. Features are identified in each of the functions that correspond to instances of a set of control flow fragment types. A feature set is generated for the sample from the identified features.
Claims23
At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
- identify a particular sample comprising code;
- generate a structure to represent the particular sample, wherein the structure represents a plurality of functions included in the particular sample;
- identify, in each of the functions, respective control flow fragments of the function;
- identify a subset of the fragments of the plurality of functions as features of the particular sample based on each of the subset of fragments comprising an instance of a respective one of a predefined set of fragment types;
- generate a feature set for the particular sample from the identified features;
- and
- classify the particular sample based on a determination that feature sets of a cluster of other samples overlap with the feature set of the particular sample.
4 more elements
A method comprising:
- identifying a particular sample comprising code;
- generating, using at least one data processing apparatus, a structure for the particular sample, wherein the structure represents a plurality of functions included in the particular sample;
- identifying, using at least one data processing apparatus, in each of the functions, respective fragments of the function;
- identify a subset of the fragments of the plurality of functions as features of the particular sample based on each of the subset of fragments comprising an instance of a respective one of a predefined set of fragment types;
- generating, using at least one data processing apparatus, a feature set for the particular sample from the identified features;
- and
- classifying the particular sample based on a determination that feature sets of a cluster of other samples overlap with the feature set of the particular sample.
4 more elements
A system comprising:
- at least one processor device;
- at least one memory element;
- and
- a feature set builder, when executed by the at least one processor device, to:
- identify a particular sample comprising code;
- generate a structure for the particular sample, wherein the structure represents a plurality of functions included in the particular sample;
- identify, in each of the functions, respective fragments of the function;
- identify a subset of the fragments of the plurality of functions as features of the particular sample based on each of the subset of fragments comprising an instance of a respective one of a predefined set of fragment types;
- generate a feature set for the particular sample from the identified subset of the fragments;
- and
- classify the particular sample based on a determination that feature sets of a cluster of other samples overlap with the feature set of the particular sample.
8 more elements
Dependencies are inferred from the claim text.