System, method and computer program product for identifying functions in computer code that control a behavior thereof when executed
View Patent ↗A security data structure, method and computer program product are provided. In use, computer code is received. Furthermore, functions in the computer code that control a behavior of the computer code when executed are statically identified.
1. A method, comprising:
identifying, in a first computer code, control functions that control behavior, wherein the identifying is performed in conjunction with a processor configured to identify particular functions in the first computer code that exceed a complexity threshold;
creating a first vector associated with at least one of the control functions;
comparing the first vector and a second vector associated with a second computer code, which is associated with undesirable code; and
identifying a similarity between the first computer code and the second computer code based on the comparing of the first vector and the second vector.
2. The method of claim 1 , further comprising:
generating a code similarity value associated with comparing the first computer code and the second computer code.
3. The method of claim 2 , wherein a metric that is associated with a function congruency table, which reflects similarities between the first and the second computer code, serves as a multiplier to the code similarity value for generating an output.
4. The method of claim 1 , wherein identifying the control functions comprises:
calculating a complexity value for each function in the first computer code based on a value of at least one property associated with each function; and
identifying each function having a complexity value that exceeds the complexity threshold.
5. The method of claim 1 , wherein identifying the control functions comprises:
calculating a complexity value for each function in the first computer code based on a number of instances of at least one property associated with each function; and
identifying each function as one of the control functions if the complexity value exceeds the complexity threshold.
6. The method of claim 1 , wherein identifying the control functions comprises:
calculating a complexity value for each function in the first computer code based on a sum of property values associated with each function; and
identifying each function having a complexity value that exceeds the complexity threshold.
7. The method of claim 1 , wherein identifying the control functions comprises:
calculating a complexity value for each function in the first computer code based on a sum of property values associated with each function, wherein the property values are based on the extent to which the property values uniquely identify each function; and
identifying each function having a complexity value that exceeds the complexity threshold.
8. The method of claim 1 , wherein identifying the control functions is based on a number of functions called by segments of the first computer code.
9. The method of claim 1 , further comprising:
creating a tree data structure having at least one of the control functions; and
converting the tree data structure into a plurality of vectors.
10. The method claim 1 , wherein identifying the control functions comprises tracing a call flow of the first computer code.
11. The method of claim 1 , wherein comparing the first vector to the second vector comprises identifying a percentage of similar properties between the first computer code and the second computer code.
12. The method of claim 1 , further comprising:
identifying a complexity characteristic associated with the control functions; and
identifying a subset of the control functions having a highest total complexity value.
13. The method of claim 1 , wherein comparing the first vector to the second vector comprises mapping at least one of the control functions based on a function congruency value that exceeds a function congruency threshold.
14. The method of claim 1 , wherein comparing the first vector to the second vector comprises mapping the control functions based on a complexity characteristic and a similarity characteristic of the control functions.
15. The method of claim 1 , wherein comparing the first vector to the second vector comprises comparing in-order sequences, in-order functions, out-of-order sequences, and out-of-order functions.
16. The method of claim 1 , wherein the first vector is part of a control tree generated for each of the control functions.
17. The method of claim 1 , further comprising:
generating a function congruency table reflective of a comparison between the first computer code and the second computer code.
18. The method of claim 1 , wherein the control functions are identified during emulation of the first computer code.
19. The method of claim 1 , wherein the first computer code is received as part of network traffic propagating in a network environment.