Behavior specification, finding main, and call graph visualizations

Sayre, Kirk D.; Willems, Richard A.; Lindberg, Stephen Lanse

Title: Behavior specification, finding main, and call graph visualizations

Abstract

A process transforms compiled software into a semantic form. The process transforms the code into a semantic form. The process analyzes behavior functionality by processing precise programming behavior abstractions stored in a memory and classifies the code as malware based on the code behavior. Another method identifies the starting point of execution of a compiled program. The method calculates a complexity measure by calculating the number of potential execution paths of local functions; identifies the number of arguments passed to local functions; and identifies the starting point of execution of the compiled program. Another method provides interactive, dynamic visualization of a group of related functions wherein a user can explore the rendered graph and select a specific function and display functions that are color coded by their ancestral relation and their function call distance to the selected function.

Inventors:: Sayre, Kirk D.; Willems, Richard A.; Lindberg, Stephen Lanse

Issue Date:: 2019-02-05

Research Org.:: Oak Ridge National Lab. (ORNL), Oak Ridge, TN (United States)

Sponsoring Org.:: USDOE

OSTI Identifier:: 1502364

Patent Number(s):: 10198580

Application Number:: 15/906,831

Assignee:: UT-BATTELLE, LLC (Oak Ridge, TN)

Patent Classifications (CPCs):: G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

Show more

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING
G06F21/563 - {by source code analysis}

Show less

DOE Contract Number:: AC05-00OR22725

Resource Type:: Patent

Resource Relation:: Patent File Date: 2018 Feb 27

Country of Publication:: United States

Language:: English

Subject:: 97 MATHEMATICS AND COMPUTING

Citation Formats


                    Sayre, Kirk D., Willems, Richard A., and Lindberg, Stephen Lanse. Behavior specification, finding main, and call graph visualizations.  United States: N. p., 2019. 
        Web.

Copy to clipboard


                    Sayre, Kirk D., Willems, Richard A., & Lindberg, Stephen Lanse. Behavior specification, finding main, and call graph visualizations.  United States.

Copy to clipboard


                    Sayre, Kirk D., Willems, Richard A., and Lindberg, Stephen Lanse. Tue .  
        "Behavior specification, finding main, and call graph visualizations".  United States.  https://www.osti.gov/servlets/purl/1502364.

Copy to clipboard


                    
@article{osti_1502364,

  title        = {Behavior specification, finding main, and call graph visualizations},

  author       = {Sayre, Kirk D. and Willems, Richard A. and Lindberg, Stephen Lanse},

  abstractNote = {A process transforms compiled software into a semantic form. The process transforms the code into a semantic form. The process analyzes behavior functionality by processing precise programming behavior abstractions stored in a memory and classifies the code as malware based on the code behavior. Another method identifies the starting point of execution of a compiled program. The method calculates a complexity measure by calculating the number of potential execution paths of local functions; identifies the number of arguments passed to local functions; and identifies the starting point of execution of the compiled program. Another method provides interactive, dynamic visualization of a group of related functions wherein a user can explore the rendered graph and select a specific function and display functions that are color coded by their ancestral relation and their function call distance to the selected function.},

  doi          = {},

  journal      = {},
number       = ,

  volume       = ,

  place        = {United States},

  year         = {2019},

  month        = {2}

}

Copy to clipboard

Patent:

View Patent

Save / Share:

Export Metadata

Save to My Library

Works referenced in this record:

Large-scale malware indexing using function-call graphs
conference, January 2009

Hu, Xin; Chiueh, Tzi-cker; Shin, Kang G.
Proceedings of the 16th ACM conference on Computer and communications security - CCS '09
https://doi.org/10.1145/1653662.1653736

Efficient call graph analysis
journal, September 1992

Hall, Mary W.; Kennedy, Ken
ACM Letters on Programming Languages and Systems, Vol. 1, Issue 3
https://doi.org/10.1145/151640.151643

Similar Records in DOE Patents and OSTI.GOV collections:

Methods of visualizing graphs

Patent Wong, Pak C [Richland, WA]; Mackey, Patrick S [Kennewick, WA]; Perrine, Kenneth A [Richland, WA]; ...

Methods for visualizing a graph by automatically drawing elements of the graph as labels are disclosed. In one embodiment, the method comprises receiving node information and edge information from an input device and/or communication interface, constructing a graph layout based at least in part on that information, wherein the edges are automatically drawn as labels, and displaying the graph on a display device according to the graph layout. In some embodiments, the nodes are automatically drawn as labels instead of, or in addition to, the label-edges.
Full Text Available
Detecting anomalous behavior via user authentication graphs

Patent Kent, Alexander; Neil, Joshua; Liebrock, Lorie

Significant and aggregate user authentication activity may be analyzed across a population of users and computers in one or more networks to differentiate between authorized users and intruders in a network, and/or to detect inappropriate behavior by otherwise authorized users. Dynamic graphs and graph models over user and computer authentication activity, including time-constrained models, may be used for the purposes of profiling and analyzing user behavior in computer networks. More specifically, an edge-based breadth first search of graphs may be used that enforces time-constraints while maintaining traditional breadth first search computational complexity equivalence.
Full Text Available
Detecting anomalous behavior via user authentication graphs

Patent Kent, Alexander D.; Neil, Joshua Charles; Liebrock, Lorie

Significant and aggregate user authentication activity may be analyzed across a population of users and computers in one or more networks to differentiate between authorized users and intruders in a network, and/or to detect inappropriate behavior by otherwise authorized users. Dynamic graphs and graph models over user and computer authentication activity, including time-constrained models, may be used for the purposes of profiling and analyzing user behavior in computer networks. More specifically, an edge-based breadth first search of graphs may be used that enforces time-constraints while maintaining traditional breadth first search computational complexity equivalence.
Full Text Available
Detection of counterfeit and compromised devices using system and function call tracing techniques

Patent Babun, Leonardo; Aksu, Hidayet; Uluagac, A. Selcuk

Frameworks, methods, and systems for securing a smart grid are provided. A framework can include data collection, call tracing techniques, and preparing call lists to detect counterfeit or compromised devices. The call tracing techniques can include call tracing and compiling all system and function calls over a time interval. The framework can further include data processing, in which a genuine device is identified and compared to unknown devices. A first statistical correlation can be used for resource-rich systems, and a second statistical correlation can be used for resource-limited systems. Threats of information leakage, measurement poisoning and store-and-send-later can be considered.
Full Text Available
Dispatching function calls across accelerator devices

Patent Jacob, Arpith C.; Sallenave, Olivier H.

In one embodiment, a computer-implemented method for dispatching a function call includes receiving, at a supervisor processing element (PE) and from an origin PE, an identifier of a target device, a stack frame of the origin PE, and an address of a function called from the origin PE. The supervisor PE allocates a target PE of the target device. The supervisor PE copies the stack frame of the origin PE to a new stack frame on a call stack of the target PE. The supervisor PE instructs the target PE to execute the function. The supervisor PE receives a notificationmore »« less
Full Text Available

Similar Records

Title: Behavior specification, finding main, and call graph visualizations

Abstract

Citation Formats

Large-scale malware indexing using function-call graphs conference, January 2009

Efficient call graph analysis journal, September 1992

Large-scale malware indexing using function-call graphs
conference, January 2009

Efficient call graph analysis
journal, September 1992