Code Clone Search for Obfuscated Malicious Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing code clone search tools are ineffective in detecting malicious code obfuscated through techniques like variable renaming, array rotation, and control flow flattening, especially in dynamic typing languages like JavaScript, where obfuscated code sequences are extremely long and mixed with benign code, making it difficult to identify semantic clones.
Innovation Solution
A similarity learning-based method using a code selection and abstraction layer combined with a sequential encoder, which employs a reinforcement learning approach to handle long obfuscated code sequences and identify semantic clones by encoding code snippets into vectors and calculating cosine similarity, thereby mitigating the effects of code obfuscation and mixing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code obfuscation techniques (variable renaming, array rotation, control flow flattening) are used to protect code, then code security and authorship protection are improved, but code clone detection capability deteriorates
Solution Approach 1:
The patent transforms code from its original syntactic form into vector representations that capture semantic meaning. By changing the representation parameters from surface-level syntax to deep semantic vectors, the system can detect clones regardless of obfuscation techniques that alter syntactic parameters like variable names or control flow structure.
Solution Approach 2:
The patent introduces an intermediary semantic vector representation layer between the obfuscated code and the detection process. This intermediary representation preserves the essential semantic meaning while being invariant to common obfuscation techniques, allowing clone detection to proceed effectively.
2Productivity
If traditional code clone search tools are used, then detection speed is maintained, but detection accuracy on obfuscated code deteriorates
Solution Approach 1:
The patent replaces traditional mechanical text-based comparison methods with a machine learning-based vector embedding system. This substitution enables the detection system to understand semantic meaning rather than just comparing syntax, significantly improving accuracy on obfuscated code while maintaining scalability through efficient vector operations.
3Measurement precision
If semantic understanding is improved to detect obfuscated clones, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent performs preliminary action by pre-computing semantic vector embeddings for code snippets. This preprocessing step transforms complex semantic understanding into compact vector representations that can be compared efficiently using simple operations like cosine similarity, reducing the computational complexity of the actual detection process.
Solution Approach 2:
The patent creates simplified copies of the original code in the form of vector representations. These vector copies capture the essential semantic information while being much more efficient to store and compare, allowing accurate clone detection without the computational burden of analyzing full obfuscated code sequences.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided a method and apparatus for identifying malicious code. The method uses machine learning to compare a new code segment to known code segments of malicious code. Code segments are converted to vectors and the cosine similarity of two vectors is used to identify clones. Techniques to train a neural network for handling very long code sequences and obfuscated malicious code are used.