Patent ID: 8555382

Claim:
A method for creating a set of genericized signatures for detection of byte sequences in computer code, comprising: accessing a first set of sample signatures from a malware database, each of the first set of sample signatures corresponding to an instance of malware; determining a maximum number of wildcards that a wildcarded signature may comprise; determining a first wildcarded signature corresponding to the first set of sample signatures; evaluating by a microprocessor the first wildcarded signature, the evaluating further comprising: if a number of wildcards in the first wildcarded signature exceeds the maximum number of wildcards, determining a plurality of second wildcarded signatures corresponding to a plurality of subsets of the set of sample signatures; and if the number of wildcards in the first wildcarded signature is less than or equal to the maximum number of wildcards, adding the first wildcarded signature to a set of genericized signatures; and repeating the evaluating wherein each of the second wildcarded signatures is respectively used in place of the first wildcarded signature.