Computer-implemented method for distilling a malware program in a system

A method for determining whether a to-be-tested program exhibits malicious behavior in a system including a Dalvik virtual machine, comprising:

• establishing a semantics model by extracting a first instruction set associated with security in a non-malicious program;
• tracing a program segment associated with the first instruction set using a plurality of data flow pathways;
• generating a distilled malware program by removing a part of a known malware program sample having contents identical to the semantics model;
• comparing the distilled malware program to the to-be-tested program, and when the two programs having a similarity reaching a specific standard, determining that the to-be-tested program is malicious;
• comparing the plurality of independent data flow elements with the known malware program sample, to identify the partial program;
• and
• identifying the first instruction set by disassembling the bytecode of the benign program, wherein the first instruction set comprises a privacy associated instruction set, a second instruction set unprotected by the Dalvik virtual machine, and a background automatic execution instruction set.

A method for determining whether a to-be-tested program is malicious in a system including a Dalvik virtual machine, comprising steps of:

• providing a non-malicious program containing an instruction set associated with a security;
• establishing a semantics model for the non-malicious program;
• tracing a program segment associated with the instruction set using a plurality of data flow pathways;
• removing a part of from a known malware program sample having contents identical to the semantics model to generate a distilled malware program;
• comparing the distilled malware program to the to-be-tested program, and when a similarity therebetween reaches a specific standard, then determining that the to-be-tested program is malicious;
• comparing the plurality of independent data flow elements with the known malware program sample, to identify the partial program;
• and
• identifying the instruction set by disassembling the bytecode of the benign program, wherein the instruction set comprises a privacy associated instruction set, a second instruction set unprotected by the Dalvik virtual machine, and a background automatic execution instruction set.