System and method for program security protection

1. A method for program security protection, comprising:

obtaining information of Application Programming Interface (API) calls to be executed by a first program via a prelog algorithm, wherein the prelog algorithm is configured to obtain the API call information, the prelog algorithm being executed before the API call is executed;

analyzing similarities among the obtained API call information; and

determining a security threat to the first program based on the analyzed similarities, wherein:

the obtained API call information comprises a plurality of API call information strings;

analyzing the similarities among the obtained API calls comprises determining a number of atomic operations required to change the plurality of API call information strings to a same string;

a first API call information string S has a length i;

a second API call information string T has a length j;

the number of atomic operations required to change the first API call information string S to the second API call information string T is D(Si, Tj); and

determining the number of atomic operations required to change the plurality of API call information strings to the same string comprises:

(1) in response to determining the ith string character of the first string is the same as the jth string character of the second string, obtaining D(Si−1, Tj−1) as equal to D(Si, Tj);

(2) in response to determining the ith string character of the first string is different from the jth string character of the second string, obtaining the minimum value of [D(Si−1, Tj−1)+1], [D(Si, Tj−1)+1], and [D(Si−1, Tj)+1] as equal to D(Si, Tj);

(3) recursively applying steps (1) and (2) to the first and second strings from their last string characters to obtain D(Si, Tj); and

(4) recursively applying steps (1) to (3) to all pairs of API call information strings in the plurality of API call information strings.

2. The method of claim 1 , wherein:

obtaining information of the API calls executed by the first program comprises obtaining the API call information for the API calls via the prelog and an epilog algorithms;

the prelog and the epilog algorithms are configured to obtain the API call information; and

the epilog algorithm is executed after the API call is executed.

3. The method of claim 2 , wherein:

the first program comprises a software application installed on a computing device; and

the prelog algorithm and the epilog algorithm are incorporated into an operating system of the computing device.

4. The method of claim 1 , wherein:

the obtained API call information for each API call comprises at least one of an unencrypted file, a size of data, a start position, a key, or an encrypted file.

5. The method of claim 1 , wherein:

the API calls comprise a plurality of API calls each comprising a key; and

analyzing the similarities among the obtained API calls comprises obtaining a similarity among the keys.

6. The method of claim 5 , wherein:

determining the security threat to the first program based on the analyzed similarities comprises determining the plurality of API calls as associated with the security threat, in response to the obtained similarity exceeding a threshold.

7. The method of claim 1 , wherein:

the atomic operation is selected from: inserting, deleting, or exchanging a string character.

8. A system for program security protection, comprising:

a processor; and

a non-transitory computer-readable storage medium storing instructions that, when executed by the processor, cause the system to perform a method for security protection, the method comprising:

obtaining information of Application Programming Interface (API) calls to be executed by a first program via a prelog algorithm, wherein the prelog algorithm is configured to obtain the API call information, the prelog algorithm being executed before the API call is executed;

analyzing similarities among the obtained API call information; and

determining a security threat to the first program based on the analyzed similarities, wherein:

the obtained API call information comprises a plurality of API call information strings;

analyzing the similarities among the obtained API calls comprises determining a number of atomic operations required to change the plurality of API call information strings to a same string;

a first API call information string S has a length i;

a second API call information string T has a length j;

the number of atomic operations required to change the first API call information string S to the second API call information string T is D(Si, Tj); and

determining the number of atomic operations required to change the plurality of API call information strings to the same string comprises:

(1) in response to determining the ith string character of the first string is the same as the jth string character of the second string, obtaining D(Si−1, Tj−1) as equal to D(Si, Tj);

(2) in response to determining the ith string character of the first string is different from the jth string character of the second string, obtaining the minimum value of [D(Si−1, Tj−1)+1], [D(Si, Tj−1)+1], and [D(Si−1, Tj)+1] as equal to D(Si, Tj);

(3) recursively applying steps (1) and (2) to the first and second strings from their last string characters to obtain D(Si, Tj); and

(4) recursively applying steps (1) to (3) to all pairs of API call information strings in the plurality of API call information strings.

9. The system of claim 8 , wherein:

obtaining information of the API calls executed by the first program comprises obtaining the API call information for the API calls via the prelog and an epilog algorithms;

the prelog and the epilog algorithms are configured to obtain the API call information; and

the epilog algorithm is executed after the API call is executed.

10. The system of claim 9 , wherein:

the first program comprises a software application installed on the system; and

the prelog algorithm and the epilog algorithm are incorporated into an operating system of the system.

11. The system of claim 8 , wherein:

the obtained API call information for each API call comprises at least one of an unencrypted file, a size of data, a start position, a key, or an encrypted file.

12. The system of claim 8 , wherein:

the API calls comprise a plurality of API calls each comprising a key; and

analyzing the similarities among the obtained API calls comprises obtaining a similarity among the keys.

13. The system of claim 8 , wherein:

determining the security threat to the first program based on the analyzed similarities comprises determining the plurality of API calls as associated with the security threat, in response to the obtained similarity exceeding a threshold.

14. The system of claim 8 , wherein:

the atomic operation is selected from: inserting, deleting, or exchanging a string character.