Abstract: An example method for determining a software classification is provided. The example method may include determining a plurality of substream boundaries including a first substream boundary within a representation of a software binary, and segmenting the representation of the software binary into a plurality of substreams. The example method may further include generating a first count string for a first substream based on operational class token counts in a tokenization of the first substream, where the tokenization of the first substream may be based on a mapping of commands within the first substream to operational classes. The example method may further include performing a first count string comparison with a reference database to determine a first count string match, where the first count string comparison being based on the first count string, and classifying the software binary based on the first count string match.

Abstract: An example method for determining a software classification is provided. The example method may include determining a plurality of substream boundaries including a first substream boundary within a representation of a software binary, and segmenting the representation of the software binary into a plurality of substreams. The example method may further include generating a first count string for a first substream based on operational class token counts in a tokenization of the first substream, where the tokenization of the first substream may be based on a mapping of commands within the first substream to operational classes. The example method may further include performing a first count string comparison with a reference database to determine a first count string match, where the first count string comparison being based on the first count string, and classifying the software binary based on the first count string match.

Abstract: An apparatus for rendering malware files safe for handling may include processing circuitry configured to receive a executable object, divide the executable object into a plurality of segments, remove execution capability from each of the segments, encrypt each of the segments to generate an encrypted segment set, and reassemble the encrypted segment set as a dismembered executable object.

Abstract: A method executable via operation of configured processing circuitry to identify vulnerabilities in program code may include receiving a program and employing a disassembler to disassemble the program, generating a function call tree for the program based on disassembly of the program, receiving an indication of a post condition for which analysis of the program is desired, transforming program statements into logical equations, simplifying the logical equations, propagating post conditions backwards via Dijkstra's weakest precondition variant, analyzing aliases and processing loops to generate a precondition, and using an automated solver to determine whether the precondition is realizable and, if so, providing program inputs required to realize the precondition.

Abstract: An apparatus for rendering malware files safe for handling may include processing circuitry configured to receive a executable object, divide the executable object into a plurality of segments, remove execution capability from each of the segments, encrypt each of the segments to generate an encrypted segment set, and reassemble the encrypted segment set as a dismembered executable object.

Abstract: An apparatus for identifying related code variants may include processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints, and preparing at least one report based on the similarity measure.

Abstract: A method executable via operation of configured processing circuitry to identify vulnerabilities in program code may include receiving a program and employing a disassembler to disassemble the program, generating a function call tree for the program based on disassembly of the program, receiving an indication of a post condition for which analysis of the program is desired, transforming program statements into logical equations, simplifying the logical equations, propagating post conditions backwards via Dijkstra's weakest precondition variant, analyzing aliases and processing loops to generate a precondition, and using an automated solver to determine whether the precondition is realizable and, if so, providing program inputs required to realize the precondition.

Abstract: An apparatus for identifying related code variants may include processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints, and preparing at least one report based on the similarity measure.