Patent ID: 8353040

Claim:
A method for the automatic generation of malware signatures from computer files, said method comprising: a) creating a common function library (CFL), wherein said CFL contains any functions of a computer file, which functions are identified as being part of a standard computer language used to write computer files which are known as not containing malware; b) extracting the functions of a computer file which does contain a malware; c) identifying common functions from the extracted functions, the common functions are known as not being part of a malware; d) filtering out the common functions from the extracted functions, the remaining functions are all considered as candidates for generating the malware signature; e) dividing said remaining functions into a multitude of clusters according to their location in said file; f) determining an optimal cluster from the multitude of clusters for generating the malware signature, the optimal cluster is the cluster with the highest cluster score according to: ClusterScore = C ⁢ ⁢ s F ⁢ ⁢ s + F ⁢ ⁢ c T + F ⁢ ⁢ l C ⁢ ⁢ s , wherein Cs denotes the cluster size in bytes; Fs denotes the entire file's size; Fc denotes the number of functions in said cluster; T denotes the total number of functions in said file; and Fl denotes the sum of the functions length in said cluster; and g) selecting at least one of the functions in said optimal cluster as the malware signature; the CFL is created by: i) importing a number of files containing no malware code into a function extractor; ii) processing each file in said function extractor so as to identify and extract as many functions as possible from each file's code; iii) comparing the functions extracted from the different files, wherein the functions which appear in more than one file are considered to be common; and iv) transferring and storing said common functions into the CFL for later reference.