Method and apparatus for identifying invariants to detect software tampering

1. A method of identifying invariants associated with a software package, comprising:

collecting a plurality of snapshots during execution of the software package;

applying a machine learning technique to the plurality of snapshots associated with the software package to identify a memory location within the plurality of snapshots to be a candidate invariant, wherein the plurality of snapshots comprise images of memory used during execution of the software package, and wherein applying the machine learning technique further comprises filtering the plurality of snapshots and identifying the candidate invariant from the filtered plurality of snapshots; and

determining that the candidate invariant is an invariant based on the candidate invariant being present within a majority of the plurality of snapshots.

2. The method of claim 1 further comprising generating the plurality of snapshots based on a schedule.

3. The method of claim 1 , wherein the at least one invariant comprises at least one of a static invariant or a semantic invariant.

4. The method of claim 1 , wherein applying a machine learning technique further comprises producing feature information, wherein the feature information indicates the memory location within the plurality of snapshots to be the candidate invariant, wherein the feature information is used to identify the invariant.

5. The method of claim 1 , wherein applying the machine learning technique further comprises classifying the plurality of snapshots based on a presence of the candidate invariant.

6. The method of claim 1 wherein applying the machine learning technique further comprises:

extracting the candidate invariant associated with the at least one memory location of the plurality of snapshots; and

applying at least one of a classifier or a clustering technique to the candidate invariant.

7. The method of claim 5 , wherein filtering the plurality of snapshots further comprises applying a delta compression technique to the plurality of snapshots to determine at least one second snapshot.

8. The method of claim 1 , wherein the machine learning technique comprises at least one of an n-grams analysis, a bloom filter or a longest common subsequence technique.

9. The method of claim 1 wherein the feature information indicates a memory location read as an opcode as the candidate invariant.

10. The method of claim 1 further comprising determining a violation of the invariant in memory associated with the software package.

11. The method of claim 1 further comprising training a classifier using at least one third snapshot associated with a second software package.

12. The method of claim 1 further comprising monitoring memory associated with the software package to identify malware related to a violation of the invariant.

13. An apparatus for identifying invariants associated with a software package, comprising:

a snapshot module operating on at least one processor for collecting a plurality of snapshots associated with an execution of a software package;

a feature module for identifying at least one memory location of the plurality of snapshots as at least one candidate invariant using a machine learning technique, wherein the machine learning technique comprises filtering the plurality of snapshots and identifying the candidate invariant from the filtered plurality of snapshots; and

an invariant module for selecting at least one invariant from the at least one candidate invariant based on the at least one candidate invariant being present within a majority of the plurality of snapshots.

14. The apparatus of claim 13 , wherein the feature module extracts the at least one candidate invariant from the at least one snapshot.

15. The apparatus of claim 13 , wherein the invariant module comprises a classifier for identifying the at least one invariant based on a presence of the at least one candidate invariant amongst the at least one snapshot.

16. The apparatus of claim 13 , wherein the invariant module performs a clustering technique for establishing the at least one invariant based on a presence of the at least one candidate invariant amongst the at least one snapshot.

17. The apparatus of claim 13 , wherein the feature module filters the at least one snapshot using a delta compression technique to determine at least one second snapshot.

18. A system for identifying invariants associated with a software package, comprising:

a snapshot module operating on at least one processor for collecting a plurality of snapshots associated with a software package, wherein the plurality of snapshots comprise snapshots of memory used during execution of the software package;

a feature module for identifying a memory location of the plurality of snapshots as a candidate invariant using a machine learning technique, wherein the machine learning technique comprises filtering the plurality of snapshots and identifying the candidate invariant from the filtered plurality of snapshots;

an invariant module for determining at least one invariant from the at least one candidate invariant based on the at least one candidate invariant being present within a majority of the plurality of snapshots; and

a security module for monitoring the software package to identify a violation of the at least one invariant.

19. The system of claim 18 , wherein the violation of the at least one invariant indicates that memory used during execution of the software package comprises malware.