API-call N-gram Indexing for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current static analysis techniques for identifying potentially harmful code in software packages are inefficient, taking days to scan millions of files and often result in false positives or false negatives due to their inability to keep up with changing code structures and behaviors.
Innovation Solution
The described systems and techniques use API-call n-grams to index binaries, generating API-call graphs, computing n-grams, and mapping them to an inverted index, allowing for efficient detection of potentially harmful code by comparing candidate graphs to a non-deterministic finite automaton representation of harmful behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current static analysis techniques match each signature against each graph for software package analysis, then detection thoroughness is improved, but analysis time increases to several days and scalability deteriorates
Solution Approach 1:
The patent segments the analysis process into two distinct phases: (1) an indexing phase that pre-processes software packages by extracting and indexing API-call n-grams from control flow graphs, and (2) a detection phase that queries the pre-built index. This segmentation allows the system to perform comprehensive signature matching during indexing while enabling rapid detection queries later, resolving the contradiction between thoroughness and speed.
Solution Approach 2:
The patent performs preliminary action by pre-computing and storing API-call n-grams from control flow graphs in an inverted index before actual malware detection is needed. This pre-processing step creates a ready-to-query structure that eliminates the need for time-consuming graph matching during detection, achieving both thorough analysis and fast detection times.
2Measurement precision
If comprehensive signature matching is performed across all software packages, then false positives and false negatives are reduced, but processing time extends to several days
Solution Approach 1:
The patent extracts key behavioral characteristics from control flow graphs by identifying and indexing API-call n-grams (sequences of API calls). Instead of performing complete graph matching, the system extracts these representative n-gram signatures and stores them in an inverted index, enabling rapid detection queries that maintain accuracy while dramatically reducing processing time from days to minutes.
3Reliability
If traditional graph-based matching is used for each binary, then behavioral accuracy is maintained, but computational complexity increases for millions of graphs
Solution Approach 1:
The patent creates simplified representations (copies) of the control flow graph behavior by extracting API-call n-grams. These n-gram sequences capture the essential behavioral patterns of the original graphs without requiring complete graph structure analysis. The inverted index stores these copied representations, enabling efficient querying that maintains behavioral matching accuracy while reducing computational complexity from O(n*m) to O(n+k) where k is the number of matching n-grams.
Data Source
AI summary
This document describes systems and techniques for indexing binaries of a software package and detecting potentially harmful code within the software package using API-call n-grams. A computing device generates API-call graphs from binaries. The computing device computes n-grams from the API-call graphs and adds them to an inverted index, which maps the n-grams to a respective identifier. The computing device identifies, using a signature that represents the behavior of the potentially harmful code, a set of candidate API-call graphs. The computing device can then compare, using a matching algorithm, the set of candidate API-call graphs to a non-deterministic finite automaton representation of the potentially harmful code. In this way, the described systems and techniques can use API-call n-grams to efficiently identify whether the software package includes a file that matches the behavior of potentially harmful code.