Patent Document ID: 10044750
Application ID: 14599394

Base Claim:
1. A computer-implemented method comprising: receiving a plurality of script code samples; transforming the plurality of script code samples into a plurality of tokenized samples, the transforming based on syntactical elements of the plurality of script code samples; identifying one or more similarities between at least a first tokenized sample of the plurality of tokenized samples and a second tokenized sample of the plurality of tokenized samples; based at least in part on the one or more similarities, identifying a cluster of samples including at least the first tokenized sample and the second tokenized sample; selecting the first tokenized sample as a representative sample of the cluster of samples; identifying known malicious code having a threshold similarity to the representative sample by de-obfuscating the representative sample of the cluster of samples to produce a de-obfuscated representative sample and comparing the de-obfuscated representative sample to a plurality of known malicious code samples; based on the identified known malicious code, labeling each of the samples in the cluster of samples as malicious, wherein the label of each of the samples in the cluster of samples as malicious is unscored; and generating, based at least on the unscored labeled samples in the cluster of samples, a generalized code signature, wherein the generalized code signature identifies the first tokenized sample and the second tokenized sample.

---

Claim 9:
9. The computer-implemented method of claim 1 , further comprising: determining a number of operations it would take to change one string to another string between respective ones of the plurality of tokenized samples to determine the one or more similarities in different ones of the plurality of tokenized samples.