Patent ID: 11947572
Assignee: GROUP IB TDS, LTD
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 17:
18. A system for clustering executable files comprising:
at least one processor;
at least one non-transitory computer readable medium storing instructions, which when executed by the at least one processor cause the system to:
obtain a plurality of executable files;
determine a file format of each executable file of the plurality of executable files;
launch, based on a respective file format, each executable file of the plurality of executable files in a respective isolated environment to determine a respective machine code of each one of the plurality of executable files;
generate, based on the respective machine code, a respective sample code by deleting therefrom portions non-indicative of a given executable file being affiliated with any family;
detect, in the respective sample code associated with the given executable file, repeat sequences of commands of a predetermined length,
a given command being represented by a portion of the respective machine code associated with the given executable file that includes an action to be executed by the given executable file;

determine at least one frequently occurring sequence of the repeat sequences of commands in the respective sample code;
based on the at least one frequently occurring sequence, attribute the given executable file to a respective family;
iteratively execute, detecting, determining, and attributing until one of: all of the plurality of executable files are attributed to at least one respective family, and until un-attributed files of the plurality of executable files do not contain any repeat sequences of commands; and

in response to presence of un-attributed files of the plurality of executable files, attribute each of the un-attributed files of the plurality of executable files to a separate family.