Patent ID: 8549647
Filing Date: 2013-10-01
Classification: G06F

Abstract:
1. A computer-implemented method for classifying a portable executable file, comprising: (a) initializing a malware belief (P(M)) to a predetermined value; (b) accessing, using one or more processors, an observable feature from the portable executable file; (c) obtaining a malware conditional probability for the accessed observable feature from a database of predetermined probabilities for malware; (d) obtaining a whiteware conditional probability for the accessed observable feature from a database of predetermined probabilities for whiteware; (e) applying Bayes theorem to calculate a probability that the portable executable file is malware given the malware and whiteware conditional probabilities of the accessed observable feature; (f) updating the malware belief (P(M)) with a result of Bayes theorem calculated with respect to the accessed observable feature; (g) iterating steps (c) through (f) for any additional accessible observable features, whereby a final malware belief (P(M)Final) is returned; (h) evaluating the final malware belief (P(M)Final) to classify the portable executable file as malware if the final malware belief (P(M)Final) is greater than or equal to a predetermined threshold value, or as whiteware if the final malware belief (P(M)Final) is less than the same predetermined threshold value; and (i) where the malware belief (P(M)) is evaluated after each iteration and the process returns a value for the final malware belief (P(M)Final) and the portable executable file is classified as whiteware after any iteration where the malware belief (P(M)) is less than a predetermined convergence value and the process returns a value for the final malware belief (P(M)Final) and the portable executable file is classified as malware if the malware belief (P(M)) is greater than one minus the same predetermined convergence value and the final malware belief (P(M)Final) is evaluated with regard to the distinct predetermined threshold value only after all accessed observable features have been evaluated and the predetermined convergence value is never reached.