Patent ID: 8056131
Filing Date: 2011-11-08
Classification: G06F

Abstract:
1. A method for processing transferred code, performed by a computer system executing an antivirus program stored on a non-transitory computer-readable storage media, the computer system communicating over a network, comprising: intercepting the transferred code; preprocessing said code including making copies of one or more components of said code with a transfer component and passing said copies of said one or more code components to a decomposer component, decomposing said code, valuing said code and thereby obtaining a code value, comparing said code value to a threshold value, wherein valuing said code further comprises tokenizing said code and thereby obtaining tokens for said code, and directing said code to an output path based on said code value, wherein valuing said code comprises obtaining data about the code, said data about the code including processing statistics for said code, and wherein valuing said code comprises hashing said code and obtaining a hash value for said code, wherein hashing said code comprises assigning one or more group identifications to hash values of said code; and wherein assigning one or more group identifications to hash values of said code comprises either prepending or appending a group level to said hash values of said code; whereby the probability of any particular code being proscribed code comprises a log function of a probability; and whereby said log function of a probability is compared to a proscribed code indicator to provide a numerical value for said code.