Patent Document ID: 9292688
Application ID: 14038682

Base Claim:
1. A computer-implemented method for improved zero-day malware detection comprising: receiving, at a computer that includes one or more processors and memory, a set of training files which are each known to be either malign or benign, wherein the training files comprise one or more types of computer files; analyzing, using the one or more computer processors, a training file from the set of training files to determine features of the training file, wherein the analyzing determines n-gram features; tagging, using the one or more computer processors, the determined features of the training file with qualified meta-features (QMF) tags, wherein the tagging includes: extracting one of the determined n-gram features from the training file; identifying a location of the extracted n-gram feature in the training file; determining an appropriate QMF tag of the extracted n-gram feature based on the identified location; applying the determined QMF tag to the extracted n-gram feature; and repeating the extracting, identifying, determining and applying for the remaining determined n-gram features of the training file; repeating the analyzing and tagging for remaining training files in the set of training files; and building, using the one or more computer processors, a model identifying n-gram features indicative of a malign file using the QMF-tagged n-gram features, wherein the model is capable of being used to detect malign files.

---

Claim 6:
6. The method of claim 1 further comprising receiving, using the one or more computer processors, one or more target, unknown computer files for classification; and classifying, using the one or more computer processors, the one or more target, unknown computer files as malign or benign using the model.