Patent ID: 8365288

Claim:
An anti-malware device comprising: a computer processor comprising: a communication unit which receives from a server, at least one hash coefficient and data; a hash value generating unit which generates hash values for malware patterns and a hash value for target data by using a hash function having the at least one hash coefficient; a table generating unit which generates a hash matcher table and a sub-matcher table based on the hash values for the malware patterns, the hash matcher table including indices as the hash values for the malware patterns associated with a value indicating that a collision occurs between two or more hash values mapped to a same index, and the sub-matcher table including the index associated with an offset collision pattern that maps the one of the two or more hash values to an alternate index, the sub-matcher table further associating at least one of the index and the alternate index with at least one of (i) a front value of the malware pattern and a middle value of the malware pattern and (ii) the middle value of the malware pattern and a tail value of the malware pattern, for resolving the collision; a hash matcher unit which matches the hash value of the target data to the updated hash values of the malware patterns using the hash matcher table if the collision does not occur and the sub-matcher table if the collision occurs; and a matching unit which matches the malware pattern and the target data if the hash matcher unit succeeds in the matching.