Patent ID: 8171549

Claim:
A method for analyzing code, performed by a computer system executing an antivirus program stored on a non-transitory computer-readable storage media, the computer system communicating over a network, comprising: valuing said code and thereby obtaining a code value, and, comparing said value to a threshold value, further comprising tokenizing said code and thereby obtaining tokens for said code, obtaining processing statistics for use in connection with the analysis of said code, and directing the code to an output path according to code parameters; wherein obtaining processing statistics further comprises hashing said tokenized code tokens to obtain a hash value for said token; assigning one or more group identifications to said hash value of said token, wherein assigning one or more group identifications to hash values of said token comprises translating the group identifications to a binary and either prepending or appending a group level to said hash value of said token, wherein said hash value for said token is increased by an amount of said group level binary that has been prepended to or appended to said hash value of said token; wherein said group level is a two bit appendage or prependage to said tokenized hash.