METHOD AND SYSTEM FOR DETERMINING BELONGING OF SOFTWARE BY ITS MACHINE CODE Russian patent published in 2020 - IPC G06F8/74 G06F8/75 G06F21/56 

FIELD: computer equipment.

SUBSTANCE: method of determining membership of a software (SW) to a certain family of programs based on its machine code, in which a file is obtained, comprising a machine code SW; determining format of obtained file; retrieving and storing code of functions present in the obtained file; deleting from stored code functions, which are library; selecting in each function a command; selecting "action, argument" pair in each command; converting each pair "action, argument" to number; storing, separately for each selected function, the obtained sequence of numbers; accumulating a predetermined number of machine code analysis results and detecting repeated sequences of numbers (patterns); for each detected pattern, calculating a parameter characterizing its frequency; based on the calculated set of parameters, the classifier is trained to determine the SW membership by the "action, argument" pairs sequence; trained classifier is used for subsequent determination of membership of SW to a certain family of programs.

EFFECT: technical result consists in automatic identification of software (SW) according to the sequence of machine commands executed by it.

12 cl, 4 dwg