Granted Patent B2

US 12,591,675 · App. 18/005,728 · Granted Mar 31, 2026

Inventor: Fadi El-Moussa (London, GB)

Assignee: British Telecomunications Public Limited Company

G06F21/568G06F21/54G06F21/564

Abstract

Claims (60)

1 . A computer-implemented method of automatically securing a computer system or network against a suspect binary file (SBF) by, in response to detection of the SBF, initiating an automatic defense strategy including an action known to mitigate a known threat posed by a closest known malicious binary file (KMBF), the method comprising:

identifying the closest KMBF from a plurality of KMBFs by comparing an SBF application programming interface (API) profile generated in respect of the SBF with respective KMBF API profiles generated in respect of each of the plurality of KMBFs, the SBF API profile and the KMBF API profiles being generated by:

identifying any API calls in the respective binary file,

assigning each of the identified API calls to one of a plurality of API call categories defined by one or more actions known to be effective in mitigating one or more possible threats posed by the respective API call category,

counting the number of API calls of the SBF assigned to each of the API call categories,

counting the number of API calls of the KMBF assigned to each of the API call categories, and

for each of the KMBFs:

allocating each of the API call categories an API call category matching score according to how close the number of API calls of the SBF assigned to that category is to the number of API calls of the KMBF assigned to that category, and

allocating the KMBF an API profile matching score with respect to the SBF by combining all of the API call category matching scores,

wherein the closest KMBF is identified as the one of the plurality of KMBFs with a highest API profile matching score.

2 . The method of claim 1 , wherein the plurality of API call categories comprise:

API calls which can be stymied by encrypting and/or deleting one or more categories of data;

API calls which can be stymied by enforcing file and/or application access controls;

API calls which can be stymied by blocking one or more categories of transmission and/or reception;

API calls which can be stymied by enforcing process locks and/or memory access controls; and

API calls which can be stymied by raising one or more alerts.

3 . The method of claim 1 , wherein identifying the closest KMBF is further performed by comparing an SBF branch map generated in respect of the SBF with respective KMBF branch maps generated in respect of each of the plurality of KMBFs, the SBF branch map and the KMBF branch maps being generated by breaking each of the respective binary files down into a respective sequence of blocks and determining how each block of the sequence branches to one or more other blocks of the sequence.

4 . The method of claim 3 , further comprising, for each of the KMBFs:

allocating an API profile matching score;

allocating a branch map matching score by performing tree pattern matching between the KMBF and the SBF; and

allocating a combined matching score by combining the API profile matching score with the branch map matching score;

wherein the closest KMBF is identified as the one of the plurality of KMBFs with the highest combined matching score.

5 . The method of claim 3 , further comprising generating the SBF branch map and the KMBF branch maps by identifying any branch instructions in the respective binary file, each of the branch instructions:

delineating the end of a block; and

indicating both:

one or more other blocks the block branches to, and

whether the block branches to each of the one or more other blocks conditionally or unconditionally.

6 . The method of claim 5 , further comprising, for each of the KMBFs:

allocating an API profile matching score;

allocating each identified KMBF branch instruction a branch instruction matching score with respect to a corresponding SBF branch instruction according to how close the number of one or more other blocks of the KMBF the KMBF branch instruction indicates branching to is to the number of one or more other blocks of the SBF the corresponding SBF branch instruction indicates branching to;

allocating the KMBF a branch map matching score by combining all of the branch instruction matching scores; and

allocating a combined matching score by combining the API profile matching score with the branch map matching score;

wherein the closest KMBF is identified as the one of the plurality of KMBFs with the highest combined matching score.

7 . The method of claim 6 , further comprising, for each of the KMBFs:

allocating each identified KMBF branch instruction its branch instruction matching score further according to whether the KMBF branch instruction indicates branching to a block of the KMBF that corresponds to a block of the SBF which the corresponding SBF branch instruction indicates branching to.

8 . The method of claim 7 , further comprising, for each of the KMBFs:

allocating each identified KMBF branch instruction its branch instruction matching score further according to, when the KMBF branch instruction and the corresponding SBF branch instruction both indicate branching to a plurality of other blocks, whether an alternative block of the KMBF the KMBF branch instruction indicates branching to corresponds to an alternative block of the SBF the SBF branch instructions indicates branching to.

9 . The method of claim 1 , wherein the automatic defense strategy further comprises a further action predicted to mitigate a predicted threat posed by a discrepant function present in the SBF but not the KMBF.

10 . The method of claim 9 , further comprising, in response to detection of the SBF and prior to initiating the automatic defense strategy:

identifying the discrepant function;

assigning the discrepant function to one of a plurality of function categories defined by one or more actions known to be effective in mitigating one or more possible threats posed by the respective function category; and

selecting the further action from the one or more actions known to be effective in mitigating the one or more threats posed by the one of the plurality of function categories.

11 . The method of claim 10 , wherein the plurality of function categories comprise:

functions which can be stymied by encrypting or deleting one or more categories of data;

functions which can be stymied by enforcing file or application access controls;

functions which can be stymied by blocking one or more categories of transmission or reception;

functions which can be stymied by enforcing process locks or memory access controls; and

functions which can be stymied by raising one or more alerts.

12 . The method of claim 9 , further comprising:

generating an SBF branch map in respect of the SBF and a closest KMBF branch map in respect of the closest KMBF by breaking each of the respective binary files down into a respective sequence of blocks and determining how each block of the sequence branches to one or more other blocks of the sequence; and

identifying the discrepant function by identifying a discrepant branch of the SBF branch map having no corresponding branch in the closest KMBF branch map.

13 . The method of claim 9 , further comprising identifying the discrepant function by identifying an API call category to which the number of API calls assigned from the closest KMBF is lower than the number of API calls assigned from the SBF.

14 . The method of claim 1 , wherein the action is selected from:

encrypting and/or deleting one or more categories of data;

enforcing one or more file and/or application access controls;

blocking one or more categories of transmission and/or reception;

enforcing one or more process locks and/or memory access controls; and

raising one or more alerts.

15 . A system comprising at least one processor and memory configured to perform the method of claim 1 .

16 . A non-transitory computer-readable data carrier having stored thereon a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method of claim 1 .

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (346)