BEHAVIOR SPECIFICATION, FINDING MAIN, AND CALL GRAPH VISUALIZATIONS

摘要

A process transforms compiled software into a semantic form. The process transforms the code into a semantic form. The process analyzes behavior functionality by processing precise programming behavior abstractions stored in a memory and classifies the code as malware based on the code behavior. Another method identifies the starting point of execution of a compiled program. The method calculates a complexity measure by calculating the number of potential execution paths of local functions; identifies the number of arguments passed to local functions; and identifies the starting point of execution of the compiled program. Another method provides interactive, dynamic visualization of a group of related functions wherein a user can explore the rendered graph and select a specific function and display functions that are color coded by their ancestral relation and their function call distance to the selected function.

主权项

1. A behavior computation process comprising:
transforming compiled software code into a semantic form of the compiled software; transforming the semantic form of the software code into a structured form; computing code behavior and analyzing behavior functionality by processing precise programming behavior abstractions stored in a data repository; and classifying the software code as malware based on the computing code behavior and the analysis of the behavior functionality.