Method of polymorphic detection
View Patent ↗A computer program signature may be determined based on the function flow grammar for a given source code. The function flow grammar may be determined based on reduced control flow graphs generated based on control flow graphs for each function within the source code. A polymorph of a computer program may be detected by comparing the determined computer program signature with computer program signatures, which may be included in a database.
1. A method for detecting a polymorphic instance of a known computer program, the method comprising:
generating at least one reduced control flow graph by reducing at least one control flow graph, the at least one control flow graph being based on identified functions within a suspect computer program;
generating a function flow grammar including the identified functions associated with address information from the reduced control flow graph;
generating a signature of the suspect computer program by ordering the identified functions included in the function flow grammar based on at least one characteristic associated with each function; and
comparing the generated signature with a plurality of signatures for the known computer programs, which are based on a total ordering of functions within each of the known computer programs; wherein the generating and comparing steps are executed by a computer processor.
2. The method of claim 1 , wherein the generating step further comprises:
generating the function flow grammar including the identified functions associated with static address information based on the at least one control flow graph for the identified functions; and
determining the signature of the suspect computer program by ordering the identified functions included in the function flow grammar based on the at least one characteristic associated with each function.
3. The method of claim 1 , wherein the at least one characteristic is a relative complexity of each function in the function flow grammar.
4. The method of claim 3 , wherein the relative complexity of each function is a tuple including at least one value.
5. The method of claim 3 , wherein the relative complexity is based on a quantitative analysis of each individual function.
6. The method of claim 1 , wherein the at least one characteristic is a label given to each function in the function flow grammar.
7. The method of claim 1 , further comprising:
ordering the identified functions within the function flow grammar for the suspect computer program based on the at least one characteristic associated with each of the identified functions.
8. A method for determining a signature for a computer program, the method comprising:
generating at least one reduced control flow graph by reducing at least one control flow graph, the at least one control flow graph being based on identified functions within the computer program;
generating a function flow grammar including the identified functions associated with address information from the reduced control flow graph;
determining a signature of the computer program by ordering the identified functions included in the function flow grammar based on at least one characteristic associated with each function; wherein the determining step is executed by a computer processor.
9. The method of claim 8 , wherein the determining step further comprises:
generating the function flow grammar including the identified functions associated with static address information based on the at least one control flow graph for the identified functions; and
determining the signature of the computer program by ordering the identified functions included in the function flow grammar based on the at least one characteristic associated with each function.
10. The method of claim 8 , wherein the at least one characteristic is a relative complexity of each function in the function flow grammar.
11. The method of claim 10 , wherein the relative complexity of each function is a tuple including at least one value.
12. The method of claim 10 , wherein the relative complexity is based on a quantitative analysis of each function.
13. The method of claim 8 , wherein the at least one characteristic is a label given to each function in the function flow grammar.
14. The method of claim 8 , further comprising:
ordering the identified functions within the function flow grammar for the suspect computer program based on the at least one characteristic associated with each of the identified functions.