Patent ID: 8239948

Claim:
A computer-implemented method for selecting a signature for a malware entity, the method comprising: using a computer to perform steps comprising: generating a set of candidate signatures for the malware entity; identifying, for each candidate signature, a set of features for computer program instructions contained within the candidate signature, the set of features comprising an immediate operand value used by the computer program instructions; determining, for each candidate signature, whether the features in the set of features are likely to appear in a set of non-malicious software, the determination comprising determining a frequency at which the immediate operand value appears in the set of non-malicious software; generating, for each candidate signature, a score for the candidate signature responsive to whether the features of the computer program instructions are likely to appear in the set of non-malicious software; selecting a malware signature for the malware entity from among the candidate signatures in the set based on the scores; and storing the selected malware signature.