Patent ID: 9553889
Date: 2017-01-24
CPC Classifications: G06F,H04L,H04W

Claim:
1. A method of detecting malicious files, the method comprising: analyzing, by a hardware processor, a file comprising code written in an object-oriented program language to identify at least one or more classes of the analyzed file and one or more methods contained in said one or more classes; determining, by the hardware processor, a number of the identified one or more classes and a number of the identified one or more methods of the analyzed file; identifying, by the hardware processor, a bytecode array for each identified method; determining, by the hardware processor, instructions contained in each method by identifying a corresponding operation code from the bytecode array of each method; dividing, by the hardware processor, the determined instructions for each method into a plurality of groups based on similarity of functionality among said instructions; forming, by the hardware processor, a vector for each method on the basis of the results of the division of the instructions into the plurality of groups, the vector for each method including a point in n-dimensional Euclidean space; comparing at least one of the number of classes and the number of methods of the analyzed file to known malicious files in a database to identify the known malicious files for comparison that have at least one of a number of classes and a number of methods that differs less than a predetermined percentage than the number of classes and the number of methods, respectively, of the analyzed file; comparing, by the hardware processor, the formed vectors for the methods of the analyzed file with a plurality of vectors of the identified known malicious files for comparison to determine a degree of similarity between the compared vectors; and determining, by the hardware processor, whether the analyzed file is malicious or clean based on the degree of similarity between the compared vectors.