AUTOMATED IDENTIFICATION AND REVERSE ENGINEERING OF MALWARE

摘要

An automated malware identification and reverse engineering tool is provided. Subroutine categories may be learned by machine learning. A program may then be reverse-engineered and classified, and subroutines that are potentially indicative of malware may be identified. These subroutines may be reviewed by a reverse engineer to determine whether the program is malware in a more directed and efficient manner.

主权项

1. A computer-implemented method, comprising:
automatically labeling each subroutine in a program, by a computing system, in a function call graph; applying a probabilistic approach, by the computing system, to identify at least one subroutine as potentially indicative of malware; and providing an indication of the at least one identified subroutine, by the computing system, to an analyst for further analysis.