Polymorphic Program Detection via Function Flow Grammar
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting polymorphic computer programs, such as viruses, face challenges in identifying variations in object code due to encryption, opcode reordering, and self-modification, which existing flow-graph-based detectors struggle to address effectively.
Innovation Solution
The method involves generating a function flow grammar based on control flow graphs, reducing them to exclude dynamic items, and ordering functions by relative complexity or label to create a signature for comparison with known programs, leveraging isomorphism between original and polymorphic instances.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If flow-graph-based detection methods are used to detect polymorphic computer programs, then detection capability is improved, but the methods fail to account for instruction reordering and changes in register functions, reducing detection accuracy
Solution Approach 1:
The patent segments the control flow graph into basic blocks and represents instructions within those blocks using abstract syntax trees (ASTs). This segmentation allows the system to analyze individual instruction sequences while maintaining the overall control flow structure, enabling accurate detection despite instruction reordering and register function changes.
Solution Approach 2:
The patent transforms the representation of control flow by changing parameters from concrete instruction sequences to abstracted AST representations. This parameter change allows the detection system to compare semantic equivalence rather than syntactic identity, making it invariant to instruction reordering, renaming, and register function changes while maintaining detection accuracy.
2Productivity
If automated matching with opcode recognition is implemented, then matching speed is improved, but human intervention is still required to recognize shuffled opcodes, increasing operational complexity
Solution Approach 1:
The patent implements a fully automated detection system where the abstract syntax tree comparison algorithm automatically identifies polymorphic variants without requiring human intervention. The system self-services by comparing AST representations of control flow graphs, automatically recognizing shuffled opcodes through structural equivalence rather than syntactic matching, thereby eliminating manual analysis while maintaining high accuracy.
3Reliability
If static and dynamic analysis with virtual computer execution is performed, then detection thoroughness is improved, but analysis time and computational resources increase significantly
Solution Approach 1:
The patent extracts only the essential control flow structure and instruction semantics from the computer program, representing them as abstract syntax trees within control flow graphs. By taking out only the necessary structural and semantic information rather than executing the entire program dynamically, the system achieves thorough detection capability while significantly reducing analysis time and computational resource requirements.
Data Source
AI summary
A computer program signature may be determined based on the function flow grammar for a given source code. The function flow grammar may be determined based on reduced control flow graphs generated based on control flow graphs for each function within the source code. A polymorph of a computer program may be detected by comparing the determined computer program signature with computer program signatures, which may be included in a database.