Behavior specification, finding main, and call graph visualizations

Abstract

A process transforms compiled software into a semantic form. The process transforms the code into a semantic form. The process analyzes behavior functionality by processing precise programming behavior abstractions stored in a memory and classifies the code as malware based on the code behavior. Another method identifies the starting point of execution of a compiled program. The method calculates a complexity measure by calculating the number of potential execution paths of local functions; identifies the number of arguments passed to local functions; and identifies the starting point of execution of the compiled program. Another method provides interactive, dynamic visualization of a group of related functions wherein a user can explore the rendered graph and select a specific function and display functions that are color coded by their ancestral relation and their function call distance to the selected function.

What is claimed is: 
     
         1 . A behavior computation process comprising:
 transforming compiled software code into a semantic form of the compiled software;   transforming the semantic form of the software code into a structured form;   computing code behavior and analyzing behavior functionality by processing precise programming behavior abstractions stored in a data repository; and   classifying the software code as malware based on the computing code behavior and the analysis of the behavior functionality.   
     
     
         2 . The process if  claim 1  where the process transforms the compiled software code, transforms the semantic form of the software code, computes code behavior and analyzes behavior functionality, and classifies the software code without decompiling the software code. 
     
     
         3 . The process of  claim 1  where the process that classifies the software code classifies by identifying patterns in external call behavior. 
     
     
         4 . The process of  claim 1  where the software code comprises operating system software that manages computer hardware and software resources and provides common services for computer programs. 
     
     
         5 . The process of  claim 4  where the software code further comprises application software. 
     
     
         6 . The process of  claim 1  where the process that classifies the software code classifies by processing computing libraries comprises behavior abstraction data stored in computer files of the computer's memory. 
     
     
         7 . The process of  claim 1  where the behavior functionality is accessible through a hierarchical structure of behavior levels stored in a memory stack. 
     
     
         8 . The process of  claim 1  where the transformed code is statically extracted by Hyperion-like software that determines the complied software's intentions without running the compiled software itself or processing its source code. 
     
     
         9 . The process of  claim 1  where the semantic form of the compiled software comprises an intermediary code that represents the meaning of the code rather than a structure of the computer language. 
     
     
         10 . A method of identifying the starting point of execution of a compiled program comprising:
 calculating a path based complexity by processing the execution paths of the local functions of a program;   identifying the number of arguments passed to each local function;   deriving a logarithm of the complexity measure; and   identifying a first starting point of execution of the compiled program based on the derived logarithm and the arguments passed in the function calls.   
     
     
         11 . The method of  claim 10  where the path based complexity measures the total number of software execution paths. 
     
     
         12 . The method of  claim 10  where the path based complexity measures the number of call functions. 
     
     
         13 . The method of  claim 10  where the path based complexity is a logarithmic measure. 
     
     
         14 . The method of  claim 10  where the starting posing of execution of the compiled program comprises the starting point having the highest path based complexity measure that accepts two or three arguments. 
     
     
         15 . A dynamic visualization user interface comprising:
 a central processing unit processing executable code accessed from a random access memory, in which the executable code:
 identifies the ancestral and dependent paths coupled to a selected computer function; 
 performs a first breadth-first search that follows backward-edges of a function to locate and identify the preceding functions that are coupled to the selected computer function; 
 performs a second breadth-first search that identifies the computer functions that follow the selected computer function and their function call distance from the selected computer function; and 
 rendering a color-coded representation of the processing paths that are color coded by their ancestral relation and function call distances to the selected computer function on a display. 
   
     
     
         16 . The process of  claim 15  where the dynamic visualization user interface is responsive to the selected computer function by concealing all the call functions that cannot be reached without deleting them from a display. 
     
     
         17 . The process of  claim 15  where a saturation of the colors indicates a relative call distance of a function to the selected computer function. 
     
     
         18 . The process of  claim 17  where the relative call distance comprises a minimum number of function calls required to reach the selected function or to be reached from the selected computer function. 
     
     
         19 . The process of  claim 17  where the ancestral paths comprise paths that that can reach the selected computer function through some chain of function calls and dependent paths comprise paths flow from the selected computer function. 
     
     
         20 . The process of  claim 17  where the scale of the color-coded representations is responsive to localizations and identification of processes.