Patent ID: 8250655

Claim:
A computer-implemented method for identifying new modifications of a known malicious file, the method comprising: (a) dividing a received file into a plurality of N pieces; (b) for all of the N pieces, independently calculating an average byte value, wherein the average byte value is a sum of all values of all the bytes within the piece divided by a number of bytes in that piece; (c) generating a first furl of N elements in length, wherein each element of the first furl has a value that represents the average byte value of its corresponding file piece and is independent of values of other elements; (d) generating a second furl corresponding to the known malicious file; (e) calculating a normalized distance (K N ) between the first furl and a the second furl based on differences between i-th elements of the furls and a maximum possible value of each furl element; and (f) based on the normalized distance (K N ), determining whether the received file is likely to be a modification of the known malicious file.