Malware Clustering via Function Call Graph Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The proliferation of malware variants poses a significant challenge for detection and clustering due to their modifications and obfuscation techniques, leading to increased computational complexity and difficulty in distinguishing between types and varieties, especially with conventional clustering algorithms that analyze malware samples directly.
Innovation Solution
The approach involves clustering malware samples based on their execution behavior by generating vectors from reports of their execution in a controlled environment, using feature selection and function call graphs to identify similarities, thereby reducing computational demands and improving accuracy and scalability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional clustering algorithms analyze malware samples directly, then detection accuracy may be maintained, but computational complexity increases and processing speed decreases
Solution Approach 1:
The patent segments malware analysis into two distinct phases: (1) code phase - extracting function call graphs from malware code, and (2) runtime phase - extracting function call graphs from execution behavior. This segmentation allows the system to leverage both static code analysis and dynamic runtime information without requiring simultaneous processing of all data, thereby reducing computational complexity while maintaining comprehensive detection capability.
Solution Approach 2:
The patent introduces function call graphs as an intermediary representation that bridges malware code and execution behavior. Instead of directly comparing raw malware samples or full execution traces, the system transforms both into function call graph representations, which capture essential behavioral patterns in a condensed form. This intermediary representation significantly reduces the computational burden of clustering while preserving the functional characteristics necessary for accurate malware classification.
2Measurement precision
If malware variants use obfuscation techniques, then detection difficulty increases, but the functional behavior remains identifiable through function call graphs
Solution Approach 1:
The patent inverts the traditional detection approach by not attempting to directly analyze obfuscated code patterns, but instead by executing the malware and observing its runtime function calls. Rather than trying to decipher obfuscation in static code, the system runs the malware in a controlled environment and captures the actual functional behavior through function call graphs, which remain consistent despite code obfuscation.
Solution Approach 2:
The patent changes the analysis parameter from static code characteristics to dynamic runtime behavior. By extracting function call graphs during execution, the system captures the actual operational patterns of malware variants, which remain stable regardless of code obfuscation techniques. This parameter change from static to dynamic analysis enables accurate identification of malware families even when their code representations are heavily modified.
3Measurement precision
If comprehensive malware analysis is performed, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent performs preliminary extraction of function call graphs from both malware code and execution behavior before the clustering process. By pre-processing and storing these function call graph representations, the system avoids repeated execution and analysis during clustering operations. This preliminary action captures all necessary functional information in advance, enabling faster subsequent clustering while maintaining comprehensive analysis accuracy.
Data Source
AI summary
Techniques are disclosed relating to malware clustering based on function call graph similarity. In some embodiments, a computer system may access information corresponding to a plurality of malware samples and, based on the information, generate a function call graph for each of the malware samples. In some embodiments, generating the function call graph for a given malware sample includes identifying a plurality of function calls included in the information, assigning a label to each of the function calls, identifying relationships between the function calls, and generating the function call graph based on the relationships and the labels. Based on the function call graphs, the computer system may assign each of the plurality of malware samples into one of a plurality of clusters of related malware samples.