Patent ID: 11947572
Assignee: GROUP IB TDS, LTD
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 16:
17. A system for clustering executable files comprising:
at least one processor;
at least one non-transitory computer readable medium storing instructions, which when executed by the at least one processor cause the system to:
obtain a plurality of executable files;
determine a file format of each executable file of the plurality of executable files;
for each file format:
(i) detect repeat sequences of commands of a predetermined length in a given executable file of the plurality of executable files
a given command being represented by a portion of one of a source and machine code associated with the given executable file that includes an action to be executed by the given executable file;

(ii) determine at least one frequently occurring sequence of the repeat sequences of commands in the given one of the plurality of executable files; and

based on the at least one frequently occurring sequence of commands, attribute the given executable file of the plurality of executable files to a respective family;

iteratively execute the detecting, the determining, and attributing until one of: all of the plurality of executable files are attributed to at least one respective family, and until un-attributed files of the plurality of executable files do not contain any repeat sequences of commands; and
in response to presence of un-attributed files of the plurality of executable files, attribute each of the un-attributed files of the plurality of executable files to a separate family.