Patent ID: 8806641

Claim:
A computer-implemented method for detecting malware variants, the method comprising: identifying an application package file comprising at least one class file; extracting a set of metadata fields stored within the class file from the class file; comparing the set of metadata fields stored within the class file with the set of metadata fields stored within a corresponding class file found in a known malware package to determine a similarity between the application package file and the known malware package by: for each metadata field within the set of metadata fields: assigning a weight to the metadata field; applying a similarity metric to the metadata field; applying the weight to a result of the similarity metric and including the weighted result in a summation of weighted results for the set of metadata fields; determining, based on the similarity between the application package file and the known malware package, that the application package file is a threat variant in a same threat family as the known malware package; wherein the method is performed by a computing device comprising at least one processor.