Patent Document ID: 20060037080
Application ID: 11202186
Patent Flag: 0

Claim One:
1. A computer-based method for detecting malicious executable code, comprising: establishing a database of malicious and benign executables, wherein each executable comprises executable code; extracting byte code sequences from each of the executables; creating a file of extracted byte code sequences for each of the executables; constructing n-grams from the byte codes in each of the created files; selecting the most relevant n-grams from each of the created file, based on a predetermined criteria; creating Boolean vectors for each created file, based on the presence or absence of relevant n-grams in each file; producing a set of training data by labeling each created Boolean vector as either malicious or benign; applying one or more classification methods to the set of training data to produce a set of classifiers and a set of pooled case ratings; selecting the optimal classifier from the produced set of classifiers; reapplying the one or more classification methods to the produced set of training data to produce a detection classifier; and applying the detection classifier to an executable to determine whether the executable comprises malicious executable code.