Patent ID: 9571509
Date: 2017-02-14
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method for identifying variants of samples based on similarity analysis, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: collecting, from security agents on endpoint computing systems, metadata attributes that describe samples identified by the security agents over an initial period of time to form a data repository; collecting, from the same security agents on the endpoint computing systems or different security agents on other endpoint computing systems, metadata attributes that describe a current sample identified after the initial period of time and known to comprise malware; comparing, for each sample within the data repository, at least two of the metadata attributes that describe the current sample known to comprise malware with corresponding metadata attributes of the respective sample iteratively in a search, within the data repository, for malware variants of the current sample known to comprise malware, wherein the two metadata attributes comprise at least two of: designating a sample in the data repository as a malware variant of the current sample known to comprise malware based on the comparison of the two metadata attributes during the search, within the data repository, for malware variants of the current sample known to comprise malware at least in part by determining that a degree of relatedness between the sample in the data repository and the current sample known to comprise malware satisfies a similarity threshold; and performing a security action to protect a user from malware based on the designation of the sample in the data repository as the malware variant of the current sample known to comprise malware such that the user is protected from malware.