Patent Document ID: 9454658
Application ID: 12928531
Patent Status: 1

Claim One:
1. A method comprising: for each of a plurality of sample files stored in at least one computer readable memory, 1) subdividing file code of the sample file into a plurality of code blocks each comprising one or more instructions, removing instruction parameters from each code block, and generating a code block signature for each code block; 2) removing duplicate code block signatures to leave a sequence of unique code block signatures, comparing the sequence of unique code block signatures obtained for sample files in order to identify common sections of code, wherein comparing the sequences of unique code block signatures comprises: creating a sequence table for the file, a first row of the table including the first code block signature of the sequence of unique code block signatures and each subsequent line adding on the next code block signature in the sequence, the code block signatures within each row being reordered according to a predefined sorting procedure; and searching sequence tables of other files for matching rows; and including any identified common sections of code within a database, wherein inclusion of a common section of code within the database indicates that features arising from the execution of the common section of code during a malware scan using a heuristic analysis of a file are to be disregarded as features characteristic of malware when generating a feature set to characterize or identify the file as malware.