Phylogeny Generation via N-Perm Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for comparing and classifying executable versions of computer programs, particularly malicious ones, are inadequate in accounting for minor variations and permutations, leading to difficulties in reconstructing phylogenetic relationships and distinguishing between benign and malicious code, especially in cases of code shuffling and interleaving.
Innovation Solution
The introduction of n-perms, which represent every possible permutation of an n-gram sequence, allowing for feature extraction and similarity comparison that is insensitive to character order, combined with opcode-based abstraction and term frequency scaling techniques, to assess similarities and classify programs effectively at the assembly, bytecode, or machine code levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional n-gram based sequence matching is used to compare program binaries, then the method is simple and computationally efficient, but it fails to detect code that has been permuted or reordered
Solution Approach 1:
The patent segments the program binary into fixed-size blocks and extracts n-grams from each block. By dividing the binary into manageable segments and analyzing n-gram frequencies within each segment, the method maintains computational efficiency while improving detection capability. The segmentation allows the system to handle large binaries systematically and apply statistical analysis to each segment independently.
Solution Approach 2:
The patent changes the parameter of sequence ordering by using n-gram frequency counts rather than positional sequences. Instead of matching n-grams in their original order, the method counts the frequency of each n-gram type across the binary and compares these frequency distributions. This parameter transformation makes the comparison insensitive to code reordering while preserving detection of code similarity through statistical patterns.
2Adaptability or versatility
If code reordering and permutation techniques are applied to obfuscate malware, then the malware can evade detection, but the phylogenetic relationships become harder to reconstruct
Solution Approach 1:
The patent creates a statistical copy or representation of the code's structural characteristics through n-gram frequency vectors. Instead of relying on the exact sequence of bytes or instructions, the method captures the distributional patterns of code features. This statistical copying preserves the essential characteristics of code families even when the actual code sequences are permuted or reordered, enabling phylogeny reconstruction based on pattern similarity rather than exact sequence matching.
Solution Approach 2:
The patent combines multiple n-gram frequencies into a composite frequency vector that represents the overall structural characteristics of the binary. By aggregating information from multiple n-gram types and positions into a composite statistical profile, the method creates a robust representation that is resistant to code reordering. The composite nature of this representation allows it to capture essential family characteristics while being insensitive to permutations.
3Measurement precision
If variable renaming, code encapsulation, and instruction substitution are used to hide phylogeny relationships, then the malware variants appear more diverse, but the underlying similarities remain detectable through proper feature extraction
Solution Approach 1:
The patent extracts n-gram frequency features from the binary code, separating the structural characteristics from the specific variable names and instruction encodings. By taking out and analyzing only the frequency distribution patterns rather than the exact code sequences, the method isolates the invariant characteristics that persist through obfuscation. This extraction approach focuses measurement on structural patterns that remain consistent across variants while ignoring superficial changes.
Data Source
AI summary
A method is provided for comparing malware or other types of computer programs, and for optionally using such a comparison method for (a) searching for matching programs in a collection of programs, (b) classifying programs, and (c) constructing a classification or a partitioning within a collection of programs. In general, there are three steps to the comparison portion: selecting and extracting tokens from a pair of programs for comparison, building features from these tokens, and comparing the programs based on the frequency of feature occurrences to produce a similarity measure. Pairwise similarity is then used for optionally searching, classifying, or constructing classification systems.