Patent ID: 8201244

Claim:
A system for semantic malware signature generation comprising: a function similarity analyzer configured to calculate at least one function characteristic value for an incoming file, at least one of the function characteristic values, value based at least in part on one or more functions associated with the incoming file; a classification engine configured to classify the file based at least in part on at least one of the function characteristic values; a signature generation component configured to generate one or more malware signatures corresponding to the file based at least in part on at least one of the file classification or at least one of the function characteristic values; and a runtime behavior analyzer configured to create a controlled environment, execute the incoming file within the controlled environment, and log behavior associated with the execution of the incoming file, the classification engine configured to classify the file based at least in part on the log, the signature generation component configured to generate at least one of the malware signatures based at least in part on the log, at least some of at least one of the function similarity analyzer, the classification engine, the signature generation component and the runtime behavior analyzer implemented at least in part via a processing unit.