Code conceptualization
Code conceptualization is an analysis method based on deep learning. Developed by the founders of GLIMPS and scientifically recognised, it involves directly analysing a file’s binary code at the assembly language level to extract its functional semantics, in other words, what the code actually does.
Unlike detection methods that rely on a file’s signatures or metadata, this approach focuses on the programme’s logic rather than its form. It therefore remains effective even when the code has been modified, recompiled or obfuscated.
How does code conceptualization work?
Several combined deep learning models analyse the executable code of files to extract concept codes. A concept code is neither a signature nor a fingerprint of the file: it reflects what the code does, its operational logic, regardless of how it was written or compiled.
This abstraction makes the analysis robust against evasion techniques. An attacker may recompile malware, alter its metadata or apply obfuscation to change its signature, but the functional logic of the code remains recognisable to GLIMPS Malware.
Why is code conceptualization useful for detecting malware in cybersecurity?
By focusing on the behaviour of the code rather than its fingerprint, code conceptualization makes it possible to identify threats that signature-based approaches do not cover. In particular, it detects variants of known malware, created by modifying existing code, as well as zero-day threats that have never been observed before.
This semantic analysis also facilitates investigative work: it highlights the behaviour of the functions present in the file, which helps analysts quickly understand what a suspicious file is designed to do.
How is code conceptualization used in GLIMPS solutions?
Code conceptualization lies at the heart of the Deep Engine, the deep learning-based detection engine developed by GLIMPS. It is combined with other artificial intelligence engines.
When a file submission triggers the Deep Engine, the analysis is carried out statically, without executing the file, with an average analysis time of 3 seconds.