Patent ID: 9378012
Filing Date: 2016-06-28
CPC Classification: G06F

Claim Text:
1. A computer-implemented method comprising: receiving data comprising at least a portion of a program; first identifying and retrieving entry point locations and execution-relevant metadata of the at least a portion of the program; second identifying regions of code within the at least a portion of the program based on the identified entry point locations and the metadata; first generating, based on the first identifying and the second identifying, a set of possible call sequences for at least one function; second generating an API call graph characterizing the generated set of possible call sequences for the at least one function; disassembling the at least a portion of the program into instructions; organizing the instructions into at least one function that each comprise a code block; constructing a control flow graph characterizing the at least one function; extracting application programming interface (API) call sequences by traversing the control flow graph; and determining a relative order of API calls.