Code relatives detection

1. A method comprising:

generating, through run-time execution of a code segment of a first process and using a set of input values, a dynamic instruction dependency graph representative of behavior of the executed code segment of the first process, with the dynamic instruction dependency graph comprising ranked vertices, each vertex corresponding to one or more executed instructions and associated with a ranked value, representative of an importance of the vertex relative to other vertices of the dynamic instruction dependency graph, computed according to respective number and quality of links to the each vertex;

obtaining respective one or more instruction dependency graphs representative of behaviors of code segments for one or more other processes; and

determining, based on the dynamic instruction dependency graph for the first process and the respective one or more instruction dependency graphs for the one or more other processes, a level of similarity between the first process and at least one of the one or more other processes, including comparing the computed rank values of the vertices of the dynamic instruction dependency graph to respective computed rank values of vertices in the respective one or more instruction dependency graphs for the one or more other processes.

2. The method of claim 1 , further comprising:

identifying the at least one of the one or more other processes as a code relative of the first process in response to a determination that the level of similarity between the first process and the at least one of the one or more other processes exceeds a pre-determined threshold.

3. The method of claim 1 , wherein the dynamic instruction dependency graph comprises multiple subgraph portions and data defining dependency between the multiple subgraph portions, and wherein each of the respective one or more instruction dependency graphs comprises an associated set of subgraph portions and data defining dependency between the subgraph portions.

4. The method of claim 3 , wherein determining the level of similarity between the first process and the at least one of the one or more other processes comprises:

determining, through a subgraph isomorphism process, the level of similarity between the first process and the at least one of the one or more other processes based on the multiple subgraph portions and the data defining dependency between the multiple subgraph portions for the dynamic instruction dependency graph, and based on the associated sets of subgraph portions and the data defining the dependency between the subgraph portions for the one or more instruction dependency graphs for the one or more other processes.

5. The method of claim 1 , wherein generating the dynamic instruction dependency graph comprises:

parsing the code segment for the first process into multiple dependency graphs, wherein at least one of the multiple dependency graphs corresponds to a portion of the code segment that includes a call to another process portion, and another of the multiple dependency graphs corresponds to the called other process portion.

6. The method of claim 1 , wherein generating the dynamic instruction dependency graph comprises:

generating a multi-vertices graph with edges connecting at least some of the vertices in the multi-vertices graph, with each of the edges representing a dependency between corresponding two or more instructions represented as two or more vertices in the multi-vertices graph.

7. The method of claim 6 , wherein each of the edges is assigned a dependency type value representative of a type of dependency between the instructions connected to the respective each of the edges.

8. The method of claim 6 , wherein determining the level of similarity between the first process and the at least one of the one or more other processes comprises:

deriving a first dynamic vector for the first process, representative of an ordering of the vertices of the multi-vertices graph, based on the determined ranking of the vertices.

9. The method of claim 8 , further comprising:

computing a similarity distance between the first dynamic vector for the first process and at least one dynamic vector derived for at least one of the one or more instruction dependency graphs for the at least one of the one or more other processes.

10. The method of claim 9 , further comprising:

determining that the at least one of the one or more other processes is a code relative of the first process when the similarity distance computed between the first dynamic vector and the at least one dynamic vector derived for at least one of the one or more instruction dependency graphs, corresponding to the at least one of the one or more other processes, exceeds a dynamic pre-determined dynamic threshold.

11. The method of claim 1 , wherein obtaining the respective one or more instruction dependency graphs comprises:

using a subgraph crawling subsystem to search for the respective one or more instruction dependency graphs in remote serves and repositories.

12. The method of claim 1 , wherein obtaining the respective one or more instruction dependency graphs comprises:

selecting from a plurality of candidate instruction dependency graphs the one or more instruction dependency graphs based on a determination that Euclidean distances between a distribution vector of instructions from the dynamic instruction dependency graph and respective distribution vectors of instructions for the respective one or more instruction dependency graphs exceeds a pre-determined threshold.

13. A system comprising:

at least one processor; and

storage media comprising computer instructions that, when executed on the at least one processor, cause operations comprising:

generating, through run-time execution of a code segment of a first process and using a set of input values, a dynamic instruction dependency graph representative of behavior of the executed code segment of the first process, with the dynamic instruction dependency graph comprising ranked vertices, each vertex corresponding to one or more executed instructions and associated with a ranked value, representative of an importance of the vertex relative to other vertices of the dynamic instruction dependency graph, computed according to respective number and quality of links to the each vertex;

obtaining respective one or more instruction dependency graphs representative of behaviors of code segments for one or more other processes; and

determining, based on the dynamic instruction dependency graph for the first process and the respective one or more instruction dependency graphs for the one or more other processes, a level of similarity between the first process and at least one of the one or more other processes, including comparing the computed rank values of the vertices of the dynamic instruction dependency graph to respective computed rank values of vertices in the respective one or more instruction dependency graphs for the one or more other processes.

14. The system of claim 13 , wherein the computer instructions comprise one or more further instructions to cause further operations comprising:

identifying the at least one of the one or more other processes as a code relative of the first process in response to a determination that the level of similarity between the first process and the at least one of the one or more other processes exceeds a pre-determined threshold.

15. The system of claim 13 , wherein the dynamic instruction dependency graph comprises multiple subgraph portions and data defining dependency between the multiple subgraph portions, and wherein each of the respective one or more instruction dependency graphs comprises an associated set of subgraph portions and data defining dependency between the subgraph portions.

16. The system of claim 15 , wherein determining the level of similarity between the first process and the at least one of the one or more other processes comprises:

determining, through a subgraph isomorphism process, the level of similarity between the first process and the at least one of the one or more other processes based on the multiple subgraph portions and the data defining dependency between the multiple subgraph portions for the dynamic instruction dependency graph, and based on the associated sets of subgraph portions and the data defining the dependency between the subgraph portions for the one or more instruction dependency graphs for the one or more other processes.

17. The system of claim 13 , wherein generating the dynamic instruction dependency graph comprises:

generating a multi-vertices graph with edges connecting at least some of the vertices in the multi-vertices graph, with each of the edges representing a dependency between corresponding two or more instructions represented as two or more vertices in the multi-vertices graph.

18. The system of claim 17 , wherein determining the level of similarity between the first process and the at least one of the one or more other processes comprises:

deriving a first dynamic vector for the first process, representative of an ordering of the vertices of the multi-vertices graph, based on the determined ranking of the vertices of the multi-vertices graph;

computing a similarity distance between the first dynamic vector for the first process and at least one dynamic vector derived for at least one of the one or more instruction dependency graphs for the at least one of the one or more other processes; and

determining that the at least one of the one or more other processes is a code relative of the first process when the similarity distance computed between the first dynamic vector and the at least one dynamic vector derived for at least one of the one or more instruction dependency graphs, corresponding to the at least one of the one or more other processes, exceeds a dynamic pre-determined dynamic threshold.

19. A non-transitory computer readable media storing a set of instructions executable on at least one programmable device that, when executed, causes operations comprising:

generating, through run-time execution of a code segment of a first process and using a set of input values, a dynamic instruction dependency graph representative of behavior of the executed code segment of the first process, with the dynamic instruction dependency graph comprising ranked vertices, each vertex corresponding to one or more executed instructions and associated with a ranked value, representative of an importance of the vertex relative to other vertices of the dynamic instruction dependency graph, computed according to respective number and quality of links to the each vertex;

obtaining respective one or more instruction dependency graphs representative of behaviors of code segments for one or more other processes; and

determining, based on the dynamic instruction dependency graph for the first process and the respective one or more instruction dependency graphs for the one or more other processes, a level of similarity between the first process and at least one of the one or more other processes, including comparing the computed rank values of the vertices of the dynamic instruction dependency graph to respective computed rank values of vertices in the respective one or more instruction dependency graphs for the one or more other processes.