Patent Document ID: 20170147818
Application ID: 15426769
Patent Status: 0

Claim One:
1. A method for obtaining at least one virus signature, comprising: obtaining at least one text string of characters sequence contained in a program code lines of virus samples of a virus sample set; selecting a virus signatures candidate from the at least one text string of characters sequence according to a first frequency at which each of the at least one text string of characters sequence occurs in program code lines of non-virus samples of a non-virus sample set, and a second frequency at which each of the at least one text string of characters sequence occurs in the program code lines of virus samples of the virus sample set; calculating an information entropy of the virus signatures candidate according to: a number of virus samples among the virus sample set containing the virus signatures candidate, and a number of non-virus samples among the non-virus sample set containing the virus signatures candidate; and determining whether the virus signatures candidate qualifies as a virus signature according to the calculated information entropy.