Patent ID: 9465939
Filing Date: 2016-10-11
CPC Classification: G06F

Claim Text:
1. At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor: determine a series of checksums for a file; compare the series of checksums to a checksum tree, wherein the checksum tree includes a first plurality of nodes that each include a fuzzy checksum of at least a portion of one or more known malware, and a second plurality of nodes that each include a fuzzy checksum of at least a portion of one or more known benign files, wherein each node in the checksum tree includes a classification that indicates a specific malware family or a benign file; assign one or more classifications to the file, wherein each of the one or more classifications is based on each node of the checksum tree that matches a checksum in the series of checksums; and assign a percentage to each of the one or more classifications.