Patent Document ID: 9525702
Application ID: 14843148
Patent Status: 1

Claim One:
1. A computer-implemented method comprising: receiving two or more malware samples; analyzing, by the one or more computer processors, the two or more malware samples to extract information from the two or more malware samples into an analyzer output, wherein the analyzer output represents relationships between portions of the extracted information in a hierarchical multi-level format; generating, by the one or more computer processors, at least one set of strings for each of the two or more malware samples from the analyzer output by expanding hierarchical multi-level formatted information in the output into a string format, wherein the relationships between portions of the extracted information are represented as sets of strings in the string format; determining, by the one or more computer processors, a similarity between the two or more malware samples based on the at least one set of strings for each of the two or more malware samples; and providing, for display to a user, an output indicating the similarity between the two or more malware samples.