METHOD AND APPARATUS FOR IDENTIFYING INVARIANTS TO DETECT SOFTWARE TAMPERING

Various embodiments of a method and an apparatus for identifying invariants to detect software tampering is disclosed. In one embodiment, a method of identifying invariants associated with a software package comprises applying a machine learning technique to a plurality of images associated with a software package to identify a memory location within the plurality of images to be a candidate invariant, wherein the plurality of images comprises images of memory used during execution of the software package and determining an invariant based on the candidate invariant.