Patent ID: 8381302

Claim:
A computer-implemented method for translating non-comparable values into comparable values for use in heuristics, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a file; identifying a non-comparable value associated with the file, wherein the non-comparable value comprises a hash of at least a portion of the file; translating the non-comparable value into a comparable value by: accessing a hash-frequency table that identifies the frequency of occurrence of each of a plurality file hashes within a corpus of samples; determining, by analyzing the hash-frequency table, the prevalence of the hash relative to other file hashes within the hash-frequency table; assigning a prevalence rank to the hash based on the prevalence of the hash relative to the other file hashes within the hash-frequency table; and replacing the hash with the prevalence rank; and processing the comparable value in a heuristic, wherein the processing the comparable value in the heuristic comprises: applying the heuristic to the file; and determining, at least in part by comparing the comparable value with a predetermined attribute value, whether the file represents a malicious file.