The Johns Hopkins University

Margaret F Lospinuso

Laura J Glendenning

C Durward McDonell, Iii

Ryan W Gardner

Sakunthala Harshavardhana

Douglas Charles Schmidt

Jonathan D Cohen

David R Zaret

David J Heine

Nathan S Reller

David P Silberberg

Robert M Seng

Sterling E Vinson

David M Patrone

Robert T Hider

Dennis S Patrone

Kathleen N McGill

Yanni A Kouskoulas

Benjamin R Salazar

Tzuhsiu Chiou

Forest C Deal, Jr

Vina H Nguyen

An example method for determining a software classification is provided. The example method may include determining a plurality of substream boundaries including a first substream boundary within a representation of a software binary, and segmenting the representation of the software binary into a plurality of substreams. The example method may further include generating a first count string for a first substream based on operational class token counts in a tokenization of the first substream, where the tokenization of the first substream may be based on a mapping of commands within the first substream to operational classes. The example method may further include performing a first count string comparison with a reference database to determine a first count string match, where the first count string comparison being based on the first count string, and classifying the software binary based on the first count string match.

Apparatus and method for identifying constituent parts of software binaries

An apparatus for rendering malware files safe for handling may include processing circuitry configured to receive a executable object, divide the executable object into a plurality of segments, remove execution capability from each of the segments, encrypt each of the segments to generate an encrypted segment set, and reassemble the encrypted segment set as a dismembered executable object.

Apparatus and method for enabling safe handling of malware

A method executable via operation of configured processing circuitry to identify vulnerabilities in program code may include receiving a program and employing a disassembler to disassemble the program, generating a function call tree for the program based on disassembly of the program, receiving an indication of a post condition for which analysis of the program is desired, transforming program statements into logical equations, simplifying the logical equations, propagating post conditions backwards via Dijkstra's weakest precondition variant, analyzing aliases and processing loops to generate a precondition, and using an automated solver to determine whether the precondition is realizable and, if so, providing program inputs required to realize the precondition.

Method and apparatus for automated vulnerability detection

An apparatus for identifying related code variants may include processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints, and preparing at least one report based on the similarity measure.

Apparatus and method for identifying related code variants in binaries

Growing community of inventors

Laurel, MD, United States of America

Margaret F Lospinuso