Patent ID: 8776231
Filing Date: 2014-07-08
Classification: G06F,G06K,G06N

Abstract:
1. A method for detecting unknown malicious code in a computer readable file, comprising: a) creating a Data Set being a collection of files that includes a first subset with malicious code files and a second subset with benign code files; b) identifying malicious code files and benign code files by an antivirus program; c) parsing all files using n-gram moving windows of several lengths; d) for each n-gram in each file, computing a term frequency (TF) representation, wherein the TF representation of an n-gram is the frequency of this n-gram in one of the files; e) selecting an initial set of top features of all n-grams, based on a document frequency (DF) measure, wherein the DF measure indicates those of the files containing a given n-gram; f) reducing the number of the top features to comply with the computation resources required for classifier training, by using features selection methods, wherein the features selection methods are DF measure, Gain Ratio and Fisher Score; g) determining an optimal number of features based on the evaluation of the detection accuracy of several sets of reduced top features; h) preparing different data sets with different distributions of benign code files and malicious code files, based on said optimal number, which will be used as training and test sets, wherein a percentage of malicious code files in each data set is in a range between 10% and 40% of all the files in the said data set; i) for each classifier: