System, method and computer program product for identifying functions in computer code that control a behavior thereof when executed

• US 8,327,439 B2
• Filed: 07/11/2011
• Issued: 12/04/2012
• Est. Priority Date: 05/10/2006
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Spurlock, Joel Robert, Kapoor, Aditya
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US13/180,030
• Publication Number:
  US 20110271346A1
• Time in Patent Office: 512 Days
• Field of Search: 726/24, 717/131, 717/127
• US Class Current: 726/22
• CPC Class Codes: G06F 21/563 by source code analysis

Abstract

A security data structure, method and computer program product are provided. In use, computer code is received. Furthermore, functions in the computer code that control a behavior of the computer code when executed are statically identified.

Claims

1. A method, comprising:

identifying, in a first computer code, control functions that control behavior, wherein the identifying is performed in conjunction with a processor configured to identify particular functions in the first computer code that exceed a complexity threshold;

creating a first vector associated with at least one of the control functions;

comparing the first vector and a second vector associated with a second computer code, which is associated with undesirable code; and

identifying a similarity between the first computer code and the second computer code based on the comparing of the first vector and the second vector.

2. The method of claim 1, further comprising:

generating a code similarity value associated with comparing the first computer code and the second computer code.

3. The method of claim 2, wherein a metric that is associated with a function congruency table, which reflects similarities between the first and the second computer code, serves as a multiplier to the code similarity value for generating an output.

4. The method of claim 1, wherein identifying the control functions comprises:

calculating a complexity value for each function in the first computer code based on a value of at least one property associated with each function; and

identifying each function having a complexity value that exceeds the complexity threshold.

5. The method of claim 1, wherein identifying the control functions comprises:

calculating a complexity value for each function in the first computer code based on a number of instances of at least one property associated with each function; and

identifying each function as one of the control functions if the complexity value exceeds the complexity threshold.

6. The method of claim 1, wherein identifying the control functions comprises:

calculating a complexity value for each function in the first computer code based on a sum of property values associated with each function; and

identifying each function having a complexity value that exceeds the complexity threshold.

7. The method of claim 1, wherein identifying the control functions comprises:

calculating a complexity value for each function in the first computer code based on a sum of property values associated with each function, wherein the property values are based on the extent to which the property values uniquely identify each function; and

identifying each function having a complexity value that exceeds the complexity threshold.

8. The method of claim 1, wherein identifying the control functions is based on a number of functions called by segments of the first computer code.

9. The method of claim 1, further comprising:

creating a tree data structure having at least one of the control functions; and

converting the tree data structure into a plurality of vectors.

10. The method claim 1, wherein identifying the control functions comprises tracing a call flow of the first computer code.

11. The method of claim 1, wherein comparing the first vector to the second vector comprises identifying a percentage of similar properties between the first computer code and the second computer code.

12. The method of claim 1, further comprising:

identifying a complexity characteristic associated with the control functions; and

identifying a subset of the control functions having a highest total complexity value.

13. The method of claim 1, wherein comparing the first vector to the second vector comprises mapping at least one of the control functions based on a function congruency value that exceeds a function congruency threshold.

14. The method of claim 1, wherein comparing the first vector to the second vector comprises mapping the control functions based on a complexity characteristic and a similarity characteristic of the control functions.

15. The method of claim 1, wherein comparing the first vector to the second vector comprises comparing in-order sequences, in-order functions, out-of-order sequences, and out-of-order functions.

16. The method of claim 1, wherein the first vector is part of a control tree generated for each of the control functions.

17. The method of claim 1, further comprising:

generating a function congruency table reflective of a comparison between the first computer code and the second computer code.

18. The method of claim 1, wherein the control functions are identified during emulation of the first computer code.

19. The method of claim 1, wherein the first computer code is received as part of network traffic propagating in a network environment.