Patent ID: 7434260
Filing Date: 2008-10-07
Classification: G06F

Abstract:
1. A method for detecting malicious code patterns using a static analysis in consideration of control and data flows, the method comprising: determining whether the values of tokens in two sentences of program code have the same value at the time of execution by: (a) determining, during execution, if both of the tokens of respective macro operations in the two sentences are constants for each block within a control flow graph and if said determination is true, further determining whether relevant token character strings are identical to each other; (b) determining if one of the tokens of a macro operation in the two sentences is a constant and the other token of a respective macro operation is a variable, and if said determination is true, further determining whether the relevant token character strings are identical to each other after the variable is substituted for the constant by performing a constant propagation and if said determination is true, detecting said malicious code pattern; (c) determining if both of the tokens in the two sentences are variables and have the same name and range, and if said determination is true, further determining whether there are definitions of the relevant variables in a control flow from a preceding one of the two sentences to a following one thereof by performing a copy propagation and if said determination is true, detecting said malicious code pattern; (d) determining if both of the two tokens of the two sentences are variables but do not have the same name and range, and if said determination is true, further determining whether there are definitions of the relevant variables in a control flow from a preceding one of the two sentences to a following one thereof after the relevant variables are substituted for the original variables by performing a copy propagation and if said further determination is true, detecting said malicious code pattern.