Concordia: a Google for malware

This paper introduces a new architecture for automating the generalization of program structure and the recognition of common patterns. By using massively parallel processing on large program sets we can recognize common code sequences such as loop constructs, if-then-else structures, and subroutine calls. We can also recognize common library sequences. The Concordia architecture generalizes the recognized elements so they can be collected into invariant forms. The invariant forms can be used by the analyst to understand the program being analyzed. The invariant forms can also be used to classify large numbers of programs automatically.