Abstract: Herein disclosed is a method for automatically automatically infer a recursive state machine (RSM) describing the space of acceptable input of an arbitrary binary program. This method automatically identifies atomic fields of fixed and variable lengths and syntactic elements, such as separators and terminators, and generalizes them into regular expression tokens. It constructs an RSM of tokens to represent structures such as arrays and records. Further, it constructs nested states in RSM to represent complex, nested structures. The RSM may serve as an independent parser for the program's acceptable input.

Abstract: Herein disclosed is a method for automatically extracting signatures for malware. The method takes advantage of a fundamental economic requirement of malware authors: they must reuse code to manage the time investment. The method disclosed finds shared code between malware and generates signatures from the code. A method is also disclosed for separating code that is found predominantly, if not exceptionally, in malware from code that may be found in benign program.

Abstract: Certain embodiments of the present invention are configured to facilitate analyzing computer code more efficiently. For example, by conducting a first level abstraction (e.g., symbolic interpretation and algebraic simplification) and a second level abstraction (e.g., generalization) of the computer code, the analysis may more accurately account for variations in the code that may occur as a result of register renaming, instruction reordering, choice of instructions, etc. while minimizing the cost of computations required to perform the analysis.

Abstract: Certain embodiments of the present invention are configured to facilitate analyzing computer code more efficiently. For example, by conducting a first level abstraction (e.g., symbolic interpretation and algebraic simplification) and a second level abstraction (e.g., generalization) of the computer code, the analysis may more accurately account for variations in the code that may occur as a result of register renaming, instruction reordering, choice of instructions, etc. while minimizing the cost of computations required to perform the analysis.

Abstract: Herein disclosed is a method for automatically extracting signatures for malware. The method takes advantage of a fundamental economic requirement of malware authors: they must reuse code to manage the time investment. The method disclosed finds shared code between malware and generates signatures from the code. A method is also disclosed for separating code that is found predominantly, if not exceptionally, in malware from code that may be found in benign program.

Abstract: Certain embodiments of the present invention are configured to facilitate analyzing computer code more efficiently. For example, by conducting a first level abstraction (e.g., symbolic interpretation and algebraic simplification) and a second level abstraction (e.g., generalization) of the computer code, the analysis may more accurately account for variations in the code that may occur as a result of register renaming, instruction reordering, choice of instructions, etc. while minimizing the cost of computations required to perform the analysis.

Abstract: Certain embodiments of the present invention are configured to facilitate analyzing computer code more efficiently. For example, by conducting a first level abstraction (e.g., symbolic interpretation and algebraic simplification) and a second level abstraction (e.g., generalization) of the computer code, the analysis may more accurately account for variations in the code that may occur as a result of register renaming, instruction reordering, choice of instructions, etc. while minimizing the cost of computations required to perform the analysis.

Abstract: A method is provided for comparing malware or other types of computer programs, and for optionally using such a comparison method for (a) searching for matching programs in a collection of programs, (b) classifying programs, and (c) constructing a classification or a partitioning within a collection of programs. In general, there are three steps to the comparison portion: selecting and extracting tokens from a pair of programs for comparison, building features from these tokens, and comparing the programs based on the frequency of feature occurrences to produce a similarity measure. Pairwise similarity is then used for optionally searching, classifying, or constructing classification systems.