公开(公告)号：US10783247B1

公开(公告)日：2020-09-22

申请号：US15841408

申请日：2017-12-14

申请人： Triad National Security, LLC

发明人： Shannon Steinfadt ,  Taina Immonen ,  Thomas Leitner ,  Michael Kyle

IPC分类号： G06F21/00 ,  G06F21/56

摘要： Software, such as malware, may be classified using phylogenetic techniques. An evolutionary history of a representative set of software programs may be reconstructed to generate a reference phylogeny. Dynamic traces of the representative software programs may be obtained. The dynamic traces may include time-ordered sequences of execution commands extracted from running software binaries. Metrics may be developed using the dynamic traces. One or more unknown software programs may then be classified against the reference phylogeny using the metrics developed using the dynamic traces of the representative set of software programs.