Patent ID: 8769685

Claim:
A computer-implemented method for using file paths to identify potentially malicious computer files the method comprising: identifying a file using a computing device comprising at least one processor; identifying, by the computing device, a file path associated with the file; determining, by the computing device and applying a heuristic that weights one or more alphanumeric characters within the file path based at least in part on the aggregate frequency of the alphanumeric characters, that at least a portion of the file path is likely to have been randomly generated by: determining the frequency of occurrence of each alphanumeric character within the file path; determining, based on an analysis of the frequency of occurrence of the weighted alphanumeric characters within the file path, that less-common alphanumeric characters are present within at least a portion of the file path at a similar frequency as more-common alphanumeric characters; determining the position of each alphanumeric character within the file path; determining, based on an analysis of the position of each alphanumeric character within the file path, that the distribution of alphanumeric characters within at least a portion of the file path is likely random; determining, by the computing device and based at least in part on the determination that at least a portion of the file path has likely been randomly generated, that the file is potentially malicious; performing, by the computing device, a security operation on the file upon determining that the file is potentially malicious.