Patent ID: 8635700
Filing Date: 2014-01-21
Classification: G06F

Abstract:
1. A method comprising: identifying, by at least one processor, a plurality of portions of a file; comparing, by the at least one processor, the plurality of portions of the file to a plurality of stored patterns, the plurality of stored patterns comprising portions of known malware; determining, by at least one processor, from the plurality of portions of the file and based on the comparing of the plurality of portions of the file to the plurality of stored patterns comprising portions of known malware, a set of matching portions, the set of matching portions comprising one or more of the plurality of portions of the file; determining, by at least one processor, a first score for each portion in the set of matching portions; determining an overall score for the file as a function of the first scores; comparing the overall score to a threshold to determine whether the file comprises malware, wherein the threshold is based on the context of how the file was received; and providing, by at least one processor, information regarding the set of matching portions, the information comprising the first score determined for each portion of the set of matching portions and the overall score; wherein each first score is determined based on the frequency with which each respective portion in the set of matching portions occurs in the plurality of stored patterns.