Patent ID: 7707634
Filing Date: 2010-04-27
Classification: G06F

Abstract:
1. A computer-implemented malware detection system for determining whether an executable script is malware according to functional variables and subroutines of the executable script, the malware detection system comprising: a malware signature store including at least one known malware script signature, wherein each malware signature in the malware signature store is a normalized signature of a known malware script; a normalization module that obtains an executable script and generates a normalized signature for the executable script, wherein generating a normalized signature for the executable script comprises normalizing variables and subroutines from the executable script into normalized variables and subroutines conforming to a common format suitable for comparison with that at least one malware signature in the malware signature store, the normalizing comprising renaming variables and subroutines from the executable script according to a common naming convention; and a comparison module, wherein the comparison module compares the normalized signature of the executable script to the at least one normalized malware signature in the malware signature store; wherein the malware detection system is configured to: