Patent ID: 8931092
Filing Date: 2015-01-06
Classification: G06F

Abstract:
1. A method of computer program inspection, comprising: extracting, with at least one processor, a plurality of computer program components from a computer program object, determining a hierarchical relationship between the plurality of computer program components based on structural relationships between the computer program components; constructing, based on an eccentricity of a root component in the plurality of computer program components extracted from the computer program object, a nested relationship sequence that describes the hierarchical relationship between the root component and a subgraph of the plurality of computer program components including a leaf node; identifying a candidate set of components where the nested relationship sequence is not present in a database of known program components; comparing the nested relationship sequence constructed from the candidate set of components to known malware components; and identifying authorship of the candidate set of components based at least in part on a result of the comparison.