Malicious Software Identification via Function Call Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying malicious software based on hash values are easily bypassed by virus creators, leading to low identification accuracy due to changes in the software's hash value, such as the addition of new resources or modifications to the original code.
Innovation Solution
A method and apparatus that generate a feature sequence from a function call diagram of the software, using eigenvalues of functions in a preset function library, and employ a random forest with decision trees to identify malicious software, thereby improving identification accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If hash value comparison method is used to identify malicious software, then identification process is simple and fast, but identification accuracy deteriorates because virus creators can modify hash values by adding resources or changing code
Solution Approach 1:
The patent changes the identification parameter from static hash values to dynamic function call sequence features. Instead of comparing fixed hash values that can be easily modified, the system extracts function call sequences and their eigenvalues (call counts) to create a feature sequence that is more difficult to evade, thereby improving identification accuracy while maintaining processing efficiency
Solution Approach 2:
The patent segments the software analysis process into multiple independent steps: obtaining the function call diagram, extracting function call sequences, calculating eigenvalues, generating feature sequences, and classification. This segmentation allows each component to be optimized independently and makes the overall system more robust to evasion techniques
2Ease of manufacture
If hash value set is used for malicious software identification, then implementation is simple, but the system becomes vulnerable to evasion when virus creators modify software codes or add resources
Solution Approach 1:
The patent introduces an intermediary layer between the raw software code and the identification decision. The function call diagram and feature sequence serve as intermediaries that transform the software into a standardized representation that is harder to evade, while maintaining the simplicity of the overall implementation through automated extraction and processing
Data Source
AI summary
A method and apparatus are disclosed for identifying malicious software in the technical field of computers. The method includes: obtaining, according to a source code of to-be-detected software, a function call diagram of the software; generating a feature sequence of the software according to the function call diagram, the feature sequence including an eigenvalue of at least one feature, the feature being a function in a preset function library, and the eigenvalue of the feature being a quantity of times of calling of the function by the software; and identifying whether the software is malicious software according to the feature sequence and a random forest, the random forest including at least one decision tree, and the decision tree including reference eigenvalues of multiple features. The apparatus includes: an obtaining module, a generation module, and an identification module. The present disclosure may improve identification accuracy.