Patent Document ID: 10055584
Application ID: 15426769

Base Claim:
1. A method for obtaining at least one virus signature, the method comprising: obtaining at least one text string of characters sequence contained in program code lines of virus samples of a virus sample set; selecting a virus signatures candidate from the at least one text string of characters sequence according to a first frequency at which each of the at least one text string of characters sequence occurs in program code lines of non-virus samples of a non-virus sample set, and a second frequency at which each of the at least one text string of characters sequence occurs in the program code lines of virus samples of the virus sample set; calculating an information entropy of the virus signatures candidate, the information entropy consisting of a value calculated according to: a number of virus samples among the virus sample set containing the virus signatures candidate, a number of virus samples among the virus sample set not containing the virus signatures candidate, a number of non-virus samples among the non-virus sample set containing the virus signatures candidate, and a number of non-virus samples among the non-virus sample set not containing the virus signatures candidate; and determining whether the virus signatures candidate qualifies as a virus signature according to the calculated information entropy.

---

Claim 4:
4. The method according to claim 1 , wherein the second frequency at which each of the at least one text string of characters sequence occurs in the virus sample set is determined by: obtaining a number of virus samples of the virus sample set containing each of the at least one text string of characters sequence; and calculating the second frequency at which each of the at least one text string of characters sequence occurs in the virus sample set according to the number of virus samples containing each of the at least one text string of characters sequence.