Patent ID: 8375450

Claim:
A method of training a model for use in malware detection, said method comprising: identifying, on a computer, a training pool that includes samples of executable software programs that are known to be malware, said malware samples representing a plurality of malware families; extracting a plurality of substrings of executable code from said malware samples, each of said extracted substrings being common to at least two of said malware samples; determining the probability of each of said common substrings occurring in each of said malware families; and constructing, on said computer, a decision tree using those malware samples that include at least one of said common substrings, wherein each node of said decision tree includes a byte offset index into a computer file suspected of being malware, wherein branches of said decision tree identify possible numerical values at said byte offset index, and wherein each leaf node of said decision tree identifies one of said common substrings and identifies a byte offset into said computer file where it is likely that said common substring begins, whereby said decision tree is used to determine if said computer file is malware.