Online Code Similarity Search Using Data-Flow Graphs for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing code similarity searching methods using control-flow graphs are inefficient due to structural non-uniqueness and lack of detailed information, making it difficult to distinguish between similar code segments and detect malicious code effectively.
Innovation Solution
Utilizing data-flow graphs generated by a code deobfuscating compiler to create durable and comparable vector embeddings, combined with clustering and dimensionality reduction techniques, to identify and classify code segments for malware detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If control-flow graphs are used for code similarity searching, then the method is simple to implement, but the structural non-uniqueness and lack of detailed information make it inefficient for distinguishing similar code segments and detecting malicious code
Solution Approach 1:
The patent introduces data-flow graphs as an intermediary representation between the code and the similarity search process. The data-flow graph captures data usage patterns and relationships, serving as a mediator that preserves both the simplicity of graph-based approaches and the precision needed for accurate code similarity detection and malware identification
Solution Approach 2:
The patent transforms the code representation from control-flow based parameters to data-flow based parameters. By changing the fundamental parameter of code analysis from control flow to data flow, the system achieves both ease of implementation through graph structures and improved precision through meaningful data usage patterns
2Ease of operation
If control-flow graphs are used for code analysis, then the approach is straightforward, but it does not reveal detailed information about code segments and is easily modified by compilers and obfuscation
Solution Approach 1:
The data-flow graph acts as a robust intermediary that captures essential data usage patterns independent of control-flow variations. This intermediary representation maintains reliability against compiler modifications and obfuscation while preserving ease of analysis through systematic data-flow tracking
Solution Approach 2:
The patent substitutes the control-flow based mechanical analysis system with a data-flow based system. This substitution replaces the vulnerable control-flow approach with a more durable data-flow approach that is resistant to compiler variations and obfuscation techniques
3Measurement precision
If data-flow graphs are used for code similarity searching, then the structural uniqueness and detailed information improve detection accuracy, but the complexity of generating and processing these graphs increases
Solution Approach 1:
The patent segments the code analysis process into distinct phases: code parsing, data-flow graph generation, feature extraction, and similarity search. This segmentation manages complexity by breaking down the overall system into manageable components, each handling a specific aspect of the analysis
4Reliability
If code deobfuscation is applied to improve durability against obfuscation, then the reliability improves, but the processing time and computational resources increase
Solution Approach 1:
The patent applies code deobfuscation as a preliminary action before data-flow graph generation. By performing deobfuscation in advance, the system prepares the code in a standardized form that facilitates more efficient subsequent analysis, balancing the time cost of deobfuscation with the reliability benefits
Data Source
AI summary
Techniques relate generally to computer networks, and more specifically, for a web browser having a web browser extension for evaluating web requests using internal coordination to make asynchronous information synchronously available, prior to dispatching the web requests.