Patent ID: 8161548

Claim:
A method of training a malware classifier, said method comprising: determining a classification label that represents a type of malware, said type of malware not including benign software; determining a classification label that represents a second type of malware; creating a feature definition file that includes first features relevant to the classification of said type of malware and that includes second features relevant to the classification of said second type of malware, wherein said first and second features are combined into one feature set in said feature definition file, wherein said features include characteristics of said type of malware, DLL names and function names executed by said type of malware, and alphanumeric strings used by said type of malware; selecting software training data including software of the same type as said type of malware and software that is benign; executing a training application on a computer associated with said malware classifier and inputting said feature definition file and said software training data into said training application; and outputting a training model associated with said malware classifier on said computer, whereby said training model is arranged to assist in the identification of said type of malware and said second type of malware.