Software Affiliation Detection via Function Hashing and Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining software affiliation and authorship, such as signature analysis and stylometric approaches, are ineffective against obfuscated malware, which modifies its code to evade detection and preserve functionality, making it difficult to identify authorship or family affiliation.
Innovation Solution
A method involving a processor that receives software source code, identifies functions, generates function identifiers through hashing actions and arguments, aggregates these identifiers, and applies a trained classifier to determine affiliation with a target software, while also considering obfuscation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature analysis is used to detect malware, then detection accuracy for known malware is improved, but malware can easily evade detection through code modification and obfuscation
Solution Approach 1:
The patent segments the malware analysis into multiple independent components: extracting function commands, generating function identifiers, creating aggregated arrays, and applying classifiers. This segmentation allows each component to be optimized independently and makes the system more resilient to obfuscation in any single area.
Solution Approach 2:
The patent transforms the malware code from its original form through multiple parameter changes: converting code to function identifiers via hashing, aggregating identifiers into arrays, and transforming the array into features for classification. These parameter changes create multiple layers of abstraction that preserve functionality information while obscuring the original code structure from simple signature matching.
2Object-affected harmful factors
If code obfuscation is applied to preserve functionality, then malware can evade signature detection, but the code becomes more difficult to analyze for authorship determination
Solution Approach 1:
The patent replaces manual code analysis with an automated computational system that extracts function commands, generates identifiers through hashing, and applies machine learning classifiers. This substitution of mechanical analysis with computational processing enables the system to handle obfuscated code effectively by focusing on functional patterns rather than syntactic details.
Solution Approach 2:
The patent introduces several intermediary representations between the original obfuscated code and the final analysis: function commands as intermediaries that capture operational semantics, function identifiers as hashed representations that preserve functional equivalence, and aggregated arrays that synthesize multiple functions into classification-ready features. These intermediaries bridge the gap between obfuscated code and meaningful analysis.
3Measurement precision
If traditional stylometric analysis is used for authorship attribution, then it works well for text but is ineffective for obfuscated software code
Solution Approach 1:
The patent creates a universal analysis framework that can handle both text and obfuscated software code by focusing on functional patterns rather than language-specific features. The system extracts function commands and generates identifiers that capture the essential operational characteristics of the code, making the authorship attribution method applicable across different types of software regardless of obfuscation.
Solution Approach 2:
The patent transforms software code into a parameter representation (function identifiers through hashing) that is analogous to stylistic features in text analysis. This parameter transformation enables the application of classification techniques similar to those used in stylometry, but adapted for the functional characteristics of software code rather than linguistic features.
Data Source
AI summary
Methods and systems for determining an affiliation of a given software with target software are provided. The method comprises: receiving a software source code of the given software; executing the software source code in an isolated program environment to identify at least one outgoing request of the given software, the at least one outgoing request being indicative of at least one respective function of the software source code; generating, based on the at least one outgoing request, a respective function identifier associated with the at least one respective function; applying at least one classifier to the respective function identifier to determine a likelihood parameter indicative of the given software being affiliated to a respective target software; in response to the likelihood parameter being equal to or greater than a predetermined likelihood parameter threshold: identifying the given software as being affiliated to the respective target software.