Patent Document ID: 9838406
Application ID: 15047745
Patent Flag: 1

Claim One:
1. A malware evaluator system, comprising: a non-transitory memory storing a first variant of a malware specimen and a second variant of the malware specimen; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: scanning the first variant and the second variant with one or more malware detectors to determine a first evasiveness characteristic of the first variant and a first maliciousness characteristic of the first variant and to determine a second evasiveness characteristic of the second variant and a second maliciousness characteristic of the second variant; determining a first likelihood that the first variant meets one or more criteria based at least on the first evasiveness characteristic and the first maliciousness characteristic; determining a second likelihood that the second variant meets the one or more criteria based at least on the second evasiveness characteristic and the second maliciousness characteristic; based on determining that the first likelihood is greater than the second likelihood, selecting the first variant for mutation; and mutating the first variant to generate one or more successive variants.