Patent ID: 8321942

Claim:
A computer-implemented method for selecting a signature for a malware entity, the method comprising: storing a malware dataset that includes executable files of known malware entities and excludes executable files of known goodware entities; selecting a candidate signature for a known malware entity from the malware dataset for analysis; identifying, using the executable files of the known malware entities in the malware dataset, a set of malware entities comprising a plurality of distinct malware entities that contain the candidate signature; determining, by a computer, a diversity measurement for the candidate signature, the diversity measurement describing a diversity of the plurality of distinct malware entities that contain the candidate signature and indicating whether the candidate signature is likely to occur in goodware based on the diversity of the plurality of distinct malware entities that contain the candidate signature; determining whether to use the candidate signature to identify the known malware entity based at least in part on the diversity measurement; and storing the candidate malware signature as a signature for the known malware entity responsive to the determination to use the candidate signature.