Statistical inspection systems and methods for components and component relationships

摘要

Embodiments of an inspection system and method for a collection of information objects, for example, a collection of executable software applications may be inspected for computer viruses, or a collection of genomes may be inspected for common or unique gene sequences. Information objects may contain identified sequences of instructions, each of which may be labeled with a symbol. In the software context, programming languages may include symbols that indicate functionality. In some embodiments, an inspection of the statistical properties of the information objects and their included symbols may allow for the symbols (and thus instruction sequences) to be grouped into logical components. In some embodiments, objects that include individual logical components may be grouped together. These groupings and their dependencies may be used to determine the structure of each object by detailing its constituent components, how they relate or depend on one another, and how the information object may function.

主权项

1. A method of executable computer program inspection, comprising:
interrogating simultaneously, with at least one processor, each of a plurality of executable computer program objects stored in a tangible computer readable medium for one or more symbols that are embedded in the objects; identifying dependencies between the symbols based on the presence or absence of the symbols in at least two of the plurality of executable computer program objects; constructing a plurality of component groups, wherein each group of the plurality of component groups include executable computer program objects that share identical symbols, wherein the symbols of each component group are unique to that component group; constructing a directed graph representation of hierarchical relationships between the plurality of component groups based on the identified dependencies between the symbols in the plurality of executable computer program objects, wherein the directed graph includes each component group of the plurality of component groups as a node of the directed graph and a directed edge from a first node of the directed graph to a second node of the directed graph if all the symbols of the component associated with the second node are also present in the component associated with the first node; eliminating a component of the plurality of components that comprises exactly the same symbols as another component of the plurality of components; and storing the hierarchical relationships in a data structure.