Behavior specification, finding main, and call graph visualizations

Abstract

A process transforms compiled software into a semantic form. The process transforms the code into a semantic form. The process analyzes behavior functionality by processing precise programming behavior abstractions stored in a memory and classifies the code as malware based on the code behavior. Another method identifies the starting point of execution of a compiled program. The method calculates a complexity measure by calculating the number of potential execution paths of local functions; identifies the number of arguments passed to local functions; and identifies the starting point of execution of the compiled program. Another method provides interactive, dynamic visualization of a group of related functions wherein a user can explore the rendered graph and select a specific function and display functions that are color coded by their ancestral relation and their function call distance to the selected function.

Description

RELATED APPLICATION[0001]This application claims the benefit of priority of U.S. Provisional Pat. App. No. 62 / 034,410 filed Aug. 7, 2014 and titled “Behavior Specification and Finding Main,” which is incorporated by reference.STATEMENT REGARDING FEDERALLY SPONSORED RESEARCH AND DEVELOPMENT[0002]This invention was made with United States government support under Contract No. DE-ACO5-00OR22725 awarded by the United States Department of Energy. The United States government has certain rights in the invention.BACKGROUND[0003]1. Technical Field[0004]This disclosure relates to systems that monitor program behavior and specifically to systems that identify patterns in external function calls, systems that find the starting execution point of a compiled program, and an interactive user interface that differentiates software call functions.[0005]2. Related Art[0006]Software controls many aspects of systems used in our daily life. However, most source code is complex, making it difficult to t...

AI Technical Summary

Benefits of technology

This patent describes a system that can identify and analyze the behavior of software programs without needing to fully decompile them. This is done by using a knowledge base that stores information about program behavior in a structured form. The system can detect malicious software by identifying patterns in external function call behavior. The system includes a hierarchical structure of behavior specification units that abstract program behavior as compositions or sets of lower-level behaviors. The technical effect of this patent is that it provides a more efficient and accurate way to identify and analyze malicious software.

Problems solved by technology

However, most source code is complex, making it difficult to track, identify errors, detect vulnerabilities, or detect malware.

Current design and coding methods are vulnerable to malicious software that attempts to disable or damage computer programs or the computers themselves.

Unfortunately, functional testing alone is incapable of catching many types of errors and vulnerabilities.

Images