Patent ID: 9361458
Filing Date: 2016-06-07
CPC Classification: G06F,H04L

Claim Text:
1. A computer-implemented method comprising: reading a first machine language instruction from a sequence of machine language instructions; disassembling the first machine language instruction into a first assembly language instruction; reading a second machine language instruction from the sequence of machine language instructions; disassembling the second machine language instruction into a second assembly language instruction; forming a first group of opcodes for a first subsequence of the sequence of machine language instructions, the first group of opcodes including at least a first opcode of the first assembly language instruction and a second opcode of the second assembly language instruction; generating a first locality-sensitive hash for the first group of opcodes; and determining whether the sequence of machine language instructions comprises malicious code by comparing the first locality-sensitive hash to a reference locality sensitive hash of a known malicious sequence of machine language instructions, wherein the first machine language instruction and the second machine language instruction are part of a subsequence of the sequence of machine language instructions, wherein the subsequence is delimited by a third machine language instruction that marks an end of the subsequence.