Patent Document ID: 9521156
Application ID: 14404457
Patent Flag: 1

Claim One:
1. A system, comprising: a non-transitory memory; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: generating malware variants of malware specimens; and evaluating each of the malware variants based on a maliciousness level and an evasiveness level, wherein the maliciousness level for a malware variant is determined based on malicious characteristics exhibited by the malware variant, and wherein the evasiveness level for the malware variant is determined by submitting the malware variant to a plurality of malware detection systems to determine evasive characteristics exhibited by the malware variant; generating detector mechanisms to detect the malicious characteristics and non-malicious characteristics of the malware variants; and selecting at least one of the detector mechanisms having a rating above a predetermined level, the rating based on a number of the malicious characteristics correctly detected, a number of the non-malicious characteristics incorrectly detected, and a length of at least one of the malicious characteristics correctly detected.