Patent ID: 8365286
Filing Date: 2013-01-29
Classification: G06F

Abstract:
1. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of: identifying a functional code block that performs a particular function within executable code; transforming the functional code block into two or more generic code representations of its functionality by tokenizing the functional code block into a first generic code representation wherein tokenizing includes converting at least one variable to a predefined generic code uniquely representing the at least one variable, and wherein tokenizing excludes instruction codes and by tokenizing the function code block into a second generic code representation with one or more flags and statistical information; selecting one of the two or more generic code representations as the generic code representation for further analysis based upon a type of file being analyzed; comparing the generic code representation with a previously characterized malicious code representation; and in response to a positive correlation from the comparison, identifying the executable code as containing malicious code.