Patent ID: 8505099

Claim:
A machine-implemented method for determining whether a to-be-analyzed software is a known malware or a variant of the known malware, the machine-implemented method comprising the steps of: (A) configuring a processor to execute the to-be-analyzed software, and obtain a to-be-analyzed system call sequence that corresponds to the to-be-analyzed software with reference to a plurality of system calls made in sequence as a result of executing the to-be-analyzed software; (B) configuring the processor to determine a degree of similarity between the to-be-analyzed system call sequence and a reference system call sequence that corresponds to the known malware; and (C) configuring the processor to determine that the to-be-analyzed software is neither the known malware nor a variant of the known malware when the degree of similarity determined in step (B) is not greater than a predefined similarity threshold value; wherein step (B) includes the sub-steps of: (B-1) determining a longest common subsequence (LCS) between the to-be-analyzed system call sequence and the reference system call sequence; and (B-2) computing the degree of similarity (S) according to S=L/min(|X|,|Y|), where “X” represents the to-be-analyzed system call sequence, “Y” represents the reference system call sequence, “L” represents a length of the longest common subsequence, and “min(|X|,|Y|)” represents a length of a shorter one of the to-be-analyzed system call sequence and the reference system call sequence.