Software Affiliation Detection via Function Identifier Aggregation

The patent segments the malware analysis process into multiple stages: initial signature-based filtering for quick detection, followed by function identification and behavioral analysis for deeper inspection. This segmentation allows the system to maintain high detection speed for obvious cases while applying more sophisticated analysis only when needed, thus resolving the contradiction between speed and accuracy.

The patent introduces function identification as an intermediary layer between simple signature matching and complex behavioral analysis. By extracting and analyzing function identifiers from malware, the system creates a middle-ground approach that provides more accurate detection than signature analysis alone, while avoiding the full computational cost of complete behavioral analysis for every sample.

The patent replaces traditional mechanical/static analysis methods with dynamic analysis techniques. Instead of statically examining obfuscated code, the system executes malware in controlled environments and observes actual runtime behavior, function calls, and interactions. This substitution allows the system to penetrate obfuscation barriers by analyzing what the malware actually does rather than how it appears in static form.

The patent changes the analysis parameters from static code properties to dynamic behavioral properties. By monitoring runtime parameters such as function execution sequences, API call patterns, and memory access behaviors, the system transforms the analysis from examining obfuscated code structures to observing observable behavioral characteristics that remain consistent despite code obfuscation.

The patent establishes continuous monitoring and analysis of malware behavior across multiple execution instances. By continuously observing functional patterns, call sequences, and behavioral characteristics over time, the system maintains consistent identification of malware families even as individual samples undergo modifications. The continuous analysis creates a stable profile that captures the essential identity of malware beyond superficial changes.

The patent implements feedback mechanisms where analysis results from one malware sample inform the detection and analysis of subsequent samples. By using identified functional patterns and behavioral characteristics from analyzed malware to refine detection criteria and update knowledge bases, the system maintains consistent identification across modified variants while adapting to new evasion techniques through learned patterns.