Patent ID: 8621625

Claim:
A computer-implemented method for detecting infected files, the computer-implemented method comprising: identifying a set of characteristics of at least one invariant portion of an unchecked file; identifying a set of known-clean files; determining a distance between the set of characteristics of the invariant portion of the unchecked file and a set of characteristics of at least one corresponding invariant portion of a clean file in the set of known-clean files by: comparing the set of characteristics of the invariant portion of the unchecked file to the set of characteristics of the corresponding invariant portion of the clean file; determining how many characteristics included in the set of characteristics of the invariant portion of the unchecked file do not match the set of characteristics included in the set of characteristics of the corresponding invariant portion of the clean file; determining that the unchecked file is related to the clean file in the set of known-clean files based on the distance between the set of characteristics of the invariant portion of the unchecked file and the set of characteristics of the corresponding invariant portion of the clean file being below a threshold; determining whether the unchecked file is functionally equivalent to the clean file based on the distance between the set of characteristics of the invariant portion of the unchecked file and the set of characteristics of the corresponding invariant portion of the clean file.