Patent ID: 8464345
Filing Date: 2013-06-11
Classification: G06F,H04L

Abstract:
1. A computer-implemented method of generating a behavioral signature for detecting malicious software (malware) comprising: using a computer to collect malware behavior traces of malware in a malware dataset, the malware behavior traces describing sequential behaviors performed by the malware; using a computer to collect goodware behavior traces of goodware in a goodware dataset, the goodware behavior traces describing sequential behaviors performed by the goodware; normalizing the malware behavior traces for the malware to produce malware behavior sequences; normalizing the goodware behavior traces for the goodware to produce goodware behavior sequences; clustering similar malware and goodware behavior sequences together in a cluster, wherein the malware behavior sequences in the cluster describe behaviors of a malware family; analyzing the cluster to identify a behavior subsequence common to only the malware family; and creating a behavioral signature for the malware family using the behavior subsequence common to only the malware family.