Patent ID: 11947572
Assignee: GROUP IB TDS, LTD
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 8:
9. A method for clustering executable files, the method comprising:
obtaining a plurality of executable files;
determining a file format of each executable file of the plurality of executable files;
launching based on a respective file format, each executable file of the plurality of executable files in a respective isolated environment to determine a respective machine code of each one of the plurality of executable files;
generating based on the respective machine code, a respective sample code by deleting therefrom portions non-indicative of a given executable file being affiliated with any family;
detecting in the respective sample code associated with the given executable file, repeat sequences of commands of a predetermined length,
a given command being represented by a portion of the respective machine code associated with the given executable file that includes an action to be executed by the given executable file;

determining at least one frequently occurring sequence of the repeat sequences of commands in the respective sample code;
based on the at least one frequently occurring sequence, attributing the given executable file to a respective family;
iteratively executing the detecting, the determining, and the attributing until one of: all of the plurality of executable files are attributed to at least one respective family, and until un-attributed files of the plurality of executable files do not contain any repeat sequences of commands; and
in response to presence of un-attributed files of the plurality of executable files, attributing each of the un-attributed files of the plurality of executable files to a separate family.