Patent ID: 8479296

Claim:
A computer-implemented method for detecting unknown malware, the method comprising: generating, by a hardware processor, one or more different object genes for a plurality of known clean objects (W) and known malicious objects (B) of a plurality of different file types, wherein an object gene is a data structure containing a plurality of information elements retrieved from or associated with one or more objects and wherein different object genes contain different types of information elements characteristic of each of the plurality of different file types; analyzing, by the hardware processor, the one or more different objects genes of the plurality of known clean and malicious objects using one or more malware analysis methods; determining a level of successful malware detections of known malicious objects (  X b  B ) , wherein |X b | is the number of known malicious objects (B) identified as malicious, for the plurality of different file types using one or more combinations of malware analysis methods, wherein a combination includes at least two different malware analysis methods; determining a level of false positive detections of known clean objects (  X w  W ) , wherein |X w | is the number of known clean objects (W) identified as malicious, for each of the plurality of different file types using said one or more combinations of malware analysis methods; determining effectiveness (k) of the one or more combinations of malware analysis methods for each of the plurality of different file types using the following equation: k = {  X b  B -  X w  W , if ⁢ ⁢  X b  B -  X w  W ≥ 0 , 0 , otherwise determining a most effective combination of malware analysis methods for each of the plurality of different file types; selecting, based on a file type of an unknown object, a most effective combination of malware analysis methods, for analyzing the unknown object for presence of malware; generating one or more different object genes of the unknown object for each of the selected malware analysis methods; and analyzing each one of the generated object genes of the unknown object using the selected most effective combination of malware analysis methods to determine whether the unknown object is clean or malicious.