Patent ID: 8312546

Claim:
A method comprising: creating a first fuzzy fingerprint of a known malware file, the first fuzzy fingerprint including a first set of calculated complexity approximations and weightings for each of a plurality of blocks within the known malware file; creating a second fuzzy fingerprint of a file to be checked, the second fuzzy fingerprint including a second set of calculated complexity approximations and weightings for each of a plurality of blocks within the file to be checked; comparing the second fuzzy fingerprint to the first fuzzy fingerprint via a computerized system, the comparing including comparing the calculated complexity approximations from the second fuzzy fingerprint with a plurality of the complexity approximations from the first fuzzy fingerprint using a plurality of block-wise comparisons of the plurality of blocks within the known malware file and the plurality of blocks within the file to be checked; and calculating a similarity probability for each of the block-wise comparisons, the calculation including a respective weighting for each of the plurality of blocks within the known malware file and for each of the plurality of blocks within the file to be checked, and the calculation including an actual deviation of both blocks complexity approximation in relation to a maximum possible deviation, times a proximity factor for the comparison between an offset i in a first file x 1 and an offset j in a second file x 2 ; and calculating an overall similarity probability for the plurality of blocks compared, the overall similarity probability therefore comprising a similarity probability between the known malware file and the file to be checked.