Patent ID: 9171155
Filing Date: 2015-10-27
Classification: G06F,H04L

Abstract:
1. In a computing system that includes a processor, data storage, and input/output devices including a network interface device, and an operating system, a method for analyzing effectiveness and accuracy of a file detection rule, the method comprising: obtaining, by the computing system, the detection rule, wherein the detection rule defines criteria for distinguishing files having at least one characteristic of interest from other files lacking the at least one characteristic of interest; applying, by the computing system, the detection rule to a set of unknown files, wherein prior to the applying of the detection rule, the at least one characteristic of interest is initially undetermined for each file of the set of unknown files; comparing, by the computing system, each file from the result set to at least one file from a first set of known files known to have the at least one characteristic of interest to produce a first measure of similarity, and to at least one file from a second set of known files known to lack the at least one characteristic of interest to produce a second measure of similarity;