Systems and methods for predicting optimum run times for software samples

摘要

A computer-implemented method for predicting optimum run times for software samples may include (1) identifying a set of training data that identifies (i) a plurality of static characteristics of at least one previously executed software sample and (ii) an amount of time taken by a software-analysis mechanism to observe a threshold level of run-time behaviors of the previously executed software sample, (2) identifying a plurality of static characteristics of an additional software sample, (3) determining that the static characteristics of the additional software sample and the previously executed software sample exceed a threshold level of similarity, and then (4) predicting an optimum run time for the additional software sample based at least in part on the amount of time taken by the software-analysis mechanism to observe the threshold level of run-time behaviors of the previously executed software sample. Various other methods, systems, and computer-readable media are also disclosed.

主权项

1. A computer-implemented method for predicting optimum run times for software samples, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a set of training data that identifies:
a plurality of static characteristics of at least one software sample previously executed by at least one software-analysis mechanism;an amount of time taken by the software-analysis mechanism to observe a threshold level of run-time behaviors of the previously executed software sample by:
identifying a start time at which the software-analysis mechanism started executing the software sample;identifying a threshold time at which the software-analysis mechanism finished observing the threshold level of run-time behaviors while executing the software sample;calculating the amount of time taken by the software-analysis mechanism to observe the threshold level of run-time behaviors while executing the software sample based at least in part on the start time and the threshold time; identifying a plurality of static characteristics of an additional software sample; determining that the static characteristics of the additional software sample and the static characteristics of the previously executed software sample exceed a threshold level of similarity by comparing the static characteristics of the additional software sample with the set of training data; in response to determining that the static characteristics of the additional software sample and the static characteristics of the previously executed software sample exceed a threshold level of similarity, predicting an optimum run time for the additional software sample based at least in part on the amount of time taken by the software-analysis mechanism to observe the threshold level of run-time behaviors of the previously executed software sample, the optimum run time comprising a specific amount of time that the software-analysis mechanism is to execute the additional software sample such that, after executing the additional software sample for the specific amount of time, the software-analysis mechanism is to stop executing the additional software sample.