Patent ID: 8561193

Claim:
A computer-implemented method for analyzing malware, the method comprising: identifying a set of malware samples, wherein each malware sample within the set of malware samples is unique relative to all other malware samples within the set of malware samples; identifying, for each malware sample in the set of malware samples, a set of static strings present in the malware sample; clustering, based on the set of static strings present in each malware sample, the set of malware samples into at least one cluster of malware samples by creating a vector for each malware sample in the set of malware samples, with each dimension in the vector indicating whether the malware sample comprises a corresponding static string; generating a generic signature for the cluster of malware samples that is capable of identifying malware samples in the cluster based at least in part on an analysis of static strings present in the malware samples; wherein the computer-implemented method is performed by a computing device comprising at least one processor.