SYSTEM, METHOD AND APPARATUS FOR USABLE CODE-LEVEL STATISTICAL ANALYSIS WITH APPLICATIONS IN MALWARE DETECTION

• US 20190318088A1
• Filed: 06/26/2019
• Published: 10/17/2019
• Est. Priority Date: 11/30/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Ferrara, Pietro, Pistoia, Marco, Tripp, Omer
• Granted Patent: US 10,846,401 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 8/75 Structural analysis for program understanding
• CPC Class Codes: G06F 8/77 Software metrics
• CPC Class Codes: G06N 20/10 using kernel methods, e.g. support vector machines [SVM]
• CPC Class Codes: G06N 5/00 Computing arrangements using knowledge-based models

Abstract

A method, system, and apparatus configured to identify discriminating features in a plurality of applications, determine via code analysis, when a first application is subjected to classification, positions of the first application'"'"'s code that correspond to the discriminating features, and forward to a classification algorithm, such that according to its output the code fragments corresponding to the discriminating features are reported.

Claims

1. A method, comprising:

identifying discriminating features in a plurality of applications;

determining via code analysis, when a first application is subjected to classification, positions of the first application'"'"'s code that correspond to the discriminating features; and

forwarding to a classification algorithm, such that according to its output the code fragments corresponding to the discriminating features are reported.

2. The method according to claim 1, wherein in a case of malware detection, the classification is determined as either “

malicious”

or “

benign”

.

3. The method according to claim 1, wherein the identifying of the discriminating features is performed offline.

4. The method according to claim 1, wherein the identifying of discriminating features includes:

identifying, out of a plurality of available features, those that have above a predetermined level of discriminatory power; and

outputting, via an algorithm, the discriminating features, where a feature is considered of sufficient discriminatory power from its frequency of occurrence.

5. The method according to claim 3, wherein the identifying of features that have above a predetermined level of discriminatory power, include features that arise with a greater frequency in malicious applications compared to benign applications or vice versa.

6. The method of claim 1, further comprising:

for each feature, counting a number of vectors which are sets including feature vectors for the malicious and benign applications, respectively such that a non-default vector is determined; and

normalizing the counts of the number of vectors by dividing by an overall number of benign and malicious vectors,

wherein the outputting of the discriminating features of after normalizing the counts of the number of vectors, where a feature is considered of sufficient discriminatory power if its frequency of occurrence in malicious or benign application is greater than its frequency of occurrence in benign or malicious application by a predetermined factor.

7. The method according to claim 1, wherein the set of discriminating features are machine-learnable aspects of a program'"'"'s code that hold true of most applications with one classification but not with other classifications.

8. The method according to claim 1, wherein the determining of the positions of the first application'"'"'s code, further comprises:

given the set of discriminating features obtained through an algorithm, determining for correlations between the features and the traces arising in the input first application; and

computing a mapping function from traces to discriminating features.

9. The method according to claim 8, further comprising:

to enable the binding to a program'"'"'s text, when performing static analysis of the first application in test mode as opposed to offline training, retaining as metadata a source position of each statement;

if information of the source position is missing, substituting the information with a fully qualified class name, method signature and call site of every operation along the trace;

while statically analyzing an input application, storing the code positions corresponding to the operation traces it computes; and

when a machine learning engine makes a determination, tracing model discriminative features consistent with the determination are highlighted in a report.

10. A server, comprising:

a processor; and

a computer readable medium storing a program executed by the processor, wherein the processor is configured to;

identify discriminating features in a plurality of applications;

determine via code analysis, when a first application is subjected to classification, positions of the first application'"'"'s code that correspond to the discriminating features; and

forward to a classification algorithm, such that according to its output the code fragments corresponding to the discriminating features are reported.

11. The server according to claim 10, wherein in a case of malware detection, the classification is determined as either “

malicious”

or “

benign”

.

12. The server according to claim 10, wherein the identifying of the discriminating features is performed offline.

13. The method according to claim 10, wherein the processor identifying of discriminating features includes:

the processor identifying, out of a plurality of available features, those that have above a predetermined level of discriminatory power; and

the processor outputting, via an algorithm, the discriminating features, where a feature is considered of sufficient discriminatory power from its frequency of occurrence.

14. The sever according to claim 13, wherein the identifying of features that have above a predetermined level of discriminatory power, include features that arise with a greater frequency in malicious applications compared to benign applications or vice versa.

15. The server of claim 10, wherein:

for each feature, the processor counting a number of vectors which are sets including feature vectors for the malicious and benign applications, respectively such that a non-default vector is determined,

the processor normalizing the counts of the number of vectors by dividing by an overall number of benign and malicious vectors, and

the processor outputting of the discriminating features after normalizing the counts of the number of vectors, where a feature is considered of sufficient discriminatory power if its frequency of occurrence in malicious or benign application is greater than its frequency of occurrence in benign or malicious application by a predetermined factor.

16. The server according to claim 10, wherein the set of discriminating features are machine-learnable aspects of a program'"'"'s code that hold true of most applications with one classification but not with other classifications.

17. The server according to claim 10, wherein the processor determining of the positions of the first application'"'"'s code, further comprises:

given the set of discriminating features obtained through an algorithm, the processor determining for correlations between the features and the traces arising in the input first application; and

the processor computing a mapping function from traces to discriminating features.

18. The method according to claim 10, wherein:

to enable the binding to a program'"'"'s text, when performing static analysis of the first application in test mode as opposed to offline training, the processor retaining as metadata a source position of each statement;

if information of the source position is missing, the processor substituting the information with a fully qualified class name, method signature and call site of every operation along the trace;

while statically analyzing an input application, the processor storing the code positions corresponding to the operation traces it computes; and

when a machine learning engine makes a determination, the processor tracing model discriminative features consistent with the determination are highlighted in a report.

19. The server according to claim 10 being implemented in the clouds.

20. An apparatus configured to, comprising:

identify over a set of classified applications a set of discriminating features; and

determine via code analysis, when a first application is subjected to classification, positions of the first application'"'"'s code that correspond to discriminating features.