Combined structure and import behavior signatures based malware learning and detection

Abstract

A system has been created that represents a binary file with a combination of signatures that account for both structure as expressed by control flow and an abstraction of functionality as expressed by import behavior. The system analyses intra-subroutine control flow and calls to import code units. The system generates structure signatures for the subroutines based on the intra-subroutine control flows. The system also generates an import behavior signature based on calls to import code units and caller-callee relationships between the subroutines and the import code units. The system uses the structure signatures to identify the caller subroutines in generating the import behavior signature. The combination of structure signatures and import behavior signature allows for accurate determination of code similarity without the noise of superficial variations in code organization and other mutations or alterations that facilitate avoiding malware detection.