System, method and computer program product for identifying functions in computer code that control a behavior thereof when executed
View Patent ↗A security data structure, method and computer program product are provided. In use, computer code is received. Furthermore, functions in the computer code that control a behavior of the computer code when executed are statically identified.
1. A method, comprising:
receiving computer code;
statically identifying functions in the computer code that control a behavior of the computer code when executed, utilizing a processor;
calculating a complexity of each identified function;
creating a tree data structure for the computer code, wherein the tree data structure includes the identified functions as nodes;
converting the tree data structure into a vector of the identified functions; and
comparing the vector of the identified functions to a comparison vector of functions.
2. The method of claim 1 , wherein the computer code is binary computer code.
3. The method of claim 1 , wherein the functions are represented by computer code segments within the computer code.
4. The method of claim 1 , wherein the complexity is based on a value of at least one property associated with each identified function.
5. The method of claim 4 , wherein the at least one property includes one of: a data dependent call, a function called by the identified function, a function calling the identified function, a number of application program interfaces utilized by the identified function, a write to memory, a read from memory, and a data dependent jump.
6. The method of claim 1 , wherein the computer code is uncompiled source code.
7. The method of claim 1 , wherein statically identifying functions in the computer code that control a behavior of the computer code when executed further comprises identifying a subset of functions based on the complexity of each identified function.
8. The method of claim 7 , wherein a number of the identified functions included within the subset of functions is based on a predefined threshold.
9. The method of claim 8 , wherein the subset of functions includes a plurality of the identified functions with highest calculated complexities.
10. The method of claim 1 , wherein sequences of functions associated with the vector are compared to sequences of functions associated with the comparison vector.
11. The method of claim 10 , further comprising constructing a function congruency table, wherein the function congruency table maps the identified functions to congruent functions from other comparison computer code.
12. The method of claim 11 , wherein the mapping is based on a percentage of similarities between the identified functions and the functions from the other comparison computer code.
13. The method of claim 12 , wherein the function congruency table includes a percentage of similarities between the identified functions and the functions from the other comparison computer code.
14. The method of claim 13 , further comprising outputting a match percentage for each sequence of functions that is matched to a sequence of functions within the comparison vector, wherein the match percentage is based on the percentage of similarities.
15. The method of claim 1 , wherein the complexity for each identified function is based on a number of instances of at least one property associated with the identified function.
16. The method of claim 1 , wherein the complexity for each identified function is calculated based on a sum of property values associated with the identified function, where as part of the sum, each property value is multiplied by a number of instances of the property associated with the identified function.
17. A computer program product embodied on a non-transitory computer readable medium, comprising:
computer code for receiving computer code;
computer code for identifying functions in the received computer code that control a behavior of the received computer code when executed, utilizing at least one of a function complexity and a tree data structure;
computer code for calculating a complexity of each identified function;
computer code for creating the tree data structure for the received computer code, wherein the tree data structure includes the identified functions as nodes;
computer code for converting the tree data structure into a vector of the identified functions; and
computer code for comparing the vector of the identified functions to a comparison vector of functions.
18. A data structure embodied on a non-transitory computer readable medium for statically identifying functions in computer code that control a behavior of the computer code when executed, calculating a complexity of each identified function, creating a tree data structure for the computer code, wherein the tree data structure includes the identified functions as nodes, converting the tree data structure into a vector of the identified functions, and comparing the vector of the identified functions to a comparison vector of functions.