Patent ID: 8881286

Claim:
A method for cluster classifying virus files, comprising: A: statically analyzing, with a processor, binary data of each virus files among virus files which need to be classified, so as to obtain portable executable structure data of the each virus file; B: classifying, with the processor, the virus files which need to be classified into categories by comparing the portable executable structure data of the virus files which need to be classified, and classifying virus files with the portable executable structure data meeting a specified similarity condition into a particular category; and C: performing, with the processor, a secondary cluster classification on categorized virus files in each of the categories classified in step B, wherein for the categorized virus files in the particular category classified in the step B, the secondary cluster classification comprises: C1: statically analyzing binary data of each of the categorized virus files to obtain section data of each categorized virus file; C2: performing block-division on the section data of the each categorized virus file to obtain section data blocks of the each categorized virus file, the block-division performed with a same block division mode, and calculating a hash value of each section data block; and C3: comparing the hash values of the section data blocks of the categorized virus files, and further classifying the categorized virus files with the hash values of the section data blocks meeting a specified hash similarity into a secondary category.