Patent Document ID: 9633205
Application ID: 14602818
Patent Status: 1

Claim One:
1. A method for obtaining at least one virus signature, comprising: having a plurality of computer files stored in one or more memory locations of a host computing device; executing by a processor of the host computing device, an anti-virus program stored in a non-transitory computer-readable storage medium of the host computer device to detect if any of the plurality of computer files stored in the one or more memory locations of the host computing device are infected with one or more viruses according to an identification of at least one virus signature, comprising the host computing device performing: obtaining at least one text string of characters sequence contained in a program code line of each virus sample which is comprised within a virus sample set; selecting the at least one text string of characters sequence for use as a virus signatures candidate according to a first frequency at which the at least one text string of characters sequence occurs in the program code line of a non-virus sample which is comprised within a non-virus sample set, and a second frequency at which the at least one text string of characters sequence occurs in the program code line of the virus sample set, wherein the selecting of the at least one text string of characters sequence for use as virus signatures candidate is based upon the first frequency not exceeding a preset first frequency threshold and the second frequency exceeding a preset second frequency threshold; calculating an information entropy of the virus signatures candidate by using the following formula (1), according to the quantity of virus samples containing the virus signatures candidate, the quantity of virus samples not containing the virus signatures candidate, the quantity of non-virus samples containing the virus signatures candidate, and the quantity of non-virus samples not containing the virus signatures candidate; H = S 1 S ⁢ ( S 11 S 1 ⁢ log ⁢ S 1 S 11 + S 12 S 1 ⁢ log ⁢ S 1 S 12 ) + S 2 S ⁢ ( S 21 S 2 ⁢ log ⁢ S 2 S 21 + S 22 S 2 ⁢ log ⁢ S 2 S 22 ) ; ( 1 ) wherein H stands for the information entropy of the virus signatures candidate, S stands for the sum of the quantity of virus samples within a virus sample set and the quantity of non-virus samples in a non-virus sample set, S 1 stands for the quantity of virus samples within a virus sample set, S 11 stands for the quantity of virus samples containing the virus signatures candidate, S 12 stands for the quantity of virus samples not containing the virus signatures candidate; and S 2 stands for the quantity of non-virus samples in a non-virus sample set, S 21 stands for the quantity of non-virus samples containing the virus signatures candidate, S 22 stands for the quantity of non-virus samples not containing the virus signatures candidate; and selecting virus signatures from the virus signatures candidate according to the information entropy.