METHOD OF MODELING BEHAVIOR PATTERN OF INSTRUCTION SET IN N-GRAM MANNER, COMPUTING DEVICE OPERATING WITH THE METHOD, AND PROGRAM STORED IN STORAGE MEDIUM TO EXECUTE THE METHOD IN COMPUTING DEVICE
First Claim
1. A computing device configured to execute an instruction set, the computing device comprising:
- a system call hooker configured to hook system calls that occur by the instruction set while the instruction set is executed;
a category extractor configured to extract a category to which each of the hooked system calls belongs, with reference to category information associated with a correspondence relationship between a system call and a category;
a sequence extractor configured to extract one or more behavior sequences expressed in an N-gram manner from a full sequence of the hooked system calls, with reference to the extracted category; and
a model generator configured to generate a behavior pattern model of the system calls that occur when the instruction set is executed, based on a number of times that each of the extracted behavior sequences occurs.
1 Assignment
0 Petitions
Accused Products
Abstract
A computing device configured to execute an instruction set is provided. The computing device includes a system call hooker for hooking system calls that occur by the instruction set while the instruction set is executed, a category extractor for extracting a category to which each of the hooked system calls belongs with reference to category information associated with a correspondence relationship between a system call and a category, a sequence extractor for extracting one or more behavior sequences expressed in an N-gram manner from a full sequence of the hooked system calls with reference to the extracted category, and a model generator for generating a behavior pattern model of the system calls that occur when the instruction set is executed, based on a number of times that each of the extracted behavior sequences occurs.
-
Citations
18 Claims
-
1. A computing device configured to execute an instruction set, the computing device comprising:
-
a system call hooker configured to hook system calls that occur by the instruction set while the instruction set is executed; a category extractor configured to extract a category to which each of the hooked system calls belongs, with reference to category information associated with a correspondence relationship between a system call and a category; a sequence extractor configured to extract one or more behavior sequences expressed in an N-gram manner from a full sequence of the hooked system calls, with reference to the extracted category; and a model generator configured to generate a behavior pattern model of the system calls that occur when the instruction set is executed, based on a number of times that each of the extracted behavior sequences occurs. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A non-transitory computer-readable storage medium storing a program configured to model a behavior pattern associated with system calls that occur by an instruction set executed in a computing device, the program executing a process, in the computing device, that comprises:
-
hooking, by a processor of the computing device, the system calls while the instruction set is executed under a control of the processor; extracting, by the processor, a category to which each of the hooked system calls belongs, with reference to category information stored in at least one of a first storage of the computing device or a second storage provided separately from the computing device; extracting, by the processor, one or more behavior sequences expressed in an N-gram manner from a full sequence of the hooked system calls, with reference to the extracted category; and generating, by the processor, a model of the behavior pattern based on a characteristic of the extracted behavior sequences. - View Dependent Claims (12, 13, 14, 15)
-
-
16. A method for modeling a behavior pattern associated with system calls that occur by an instruction set executed in a computing device, the method comprising:
-
hooking, by the computing device, the system calls; extracting, by the computing device, a category to which each of the hooked system calls belongs; extracting, by the computing device, one or more behavior sequences expressed in an N-gram manner from a full sequence of the hooked system calls, with reference to the extracted category; and generating, by the computing device, a model of the behavior pattern expressed in a vector format, based on a number of times that each of the extracted behavior sequences occurs. - View Dependent Claims (17, 18)
-
Specification