Patent ID: 8291497
Filing Date: 2012-10-16
Classification: G06F

Abstract:
1. A computer-implemented method for facilitating automatic malware signature generation, at least a portion of the method being performed by a computing system comprising at least one processor, the method comprising: providing a byte sequence marked for possible inclusion within one or more malware signatures; determining a context diversity of the byte sequence within malware files each containing the byte sequence in accordance with a diversity-based heuristic, the containing malware files being a subset of a plurality of malware files, the context diversity of the byte sequence identifying differences between the containing malware files such that a higher context diversity level of the byte sequence indicates that the byte sequence has a likelihood of being representative of a sequence found in goodware and a lower context diversity of the byte sequence has a likelihood of being representative of a sequence found in malware; preventing the byte sequence from being included within the one or more malware signatures in accordance with the determined context diversity.