Patent Document ID: 9672358
Application ID: 15343844
Patent Status: 1

Claim One:
1. An apparatus, comprising: a memory; and a processor operatively coupled to the memory, the processor configured to extract, from an input binary file, an image data structure, the processor configured to scale the image data structure to a predetermined size, the processor configured to modify the image data structure to represent a grayscale image, the processor configured to calculate a modified pixel value for each pixel in the image data structure, the processor configured to define a binary vector based on the modified pixel value for each pixel in the image data structure; and the processor configured to identify a set of nearest neighbor binary vectors for the binary vector based on a comparison between the binary vector and each reference binary vector from a plurality of reference binary vectors stored in a malware detection database, the processor configured to determine a malware status of the input binary file based on the set of nearest neighbor binary vectors satisfying a similarity criterion associated with a known malware image from a known malware file.