PATENT CLAIM ANALYSIS

Application Number: 15991163
Application Type: Utility
Filing Date: 2018-05
Publication Date: 2019-03
Patent Classification: ["726", "024000"]

Abstract:
Automated malware signature generation is disclosed. Automated malware signature generation includes monitoring incoming unknown files for the presence of malware and analyzing the incoming unknown files based on both a plurality of classifiers of file behavior and a plurality of classifiers of file content. An incoming file is classified as having a particular malware classification based on the analyzing of incoming unknown files and a malware signature is generated for the incoming unknown file based on the particular malware classification. Access is provided to the malware signature.

Claim (Index 34):
A system, comprising:\n a processing unit; a memory that stores software for execution by the processing unit, the software comprising:\n an incoming unknown file monitor configured to monitor a system to detect an unknown file; \n an incoming unknown file analyzer configured to, via the processing unit,\n disassemble the unknown file to obtain one or more disassembled functions, each of the one or more disassembled functions comprising a block of assembly code that is configured to be referenced by one or more instructions, and determine a function characteristic value for each of the one or more disassembled functions; and \n determine a plurality of weight values for each one of the one or more disassembled functions based on at least the function characteristic value(s), each of the weight values for a given disassembled function indicating a reliability that the given disassembled function is an identifier of a different malware family in a plurality of known malware families; and \n \n an incoming unknown file classifier configured to characterize the unknown file as belonging to a particular one of the plurality of known malware families based on the weight values. \n a malware signature generator configured to, based on the characterization of the unknown file as belonging to the particular one of the known malware families, automatically generate a signature for the unknown file; and \n an access provider configured to provide access to the signature to an antivirus program for use in detecting malware.

Metadata:
- Claim Count in Document: 5.0
- Percentile: 93.0
- Lexical Diversity: 2.45946
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['13486518', '11523199', '15335224', '15215793', '12573300']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2473573965386822
- 35 USC 102 Novelty (BERT): 0.549470439665987
- Combined Prediction Score: 0.2775687008514128
- Mean Citation Score: 262.022526
- Max Citation Score: 397.66354
- Similarity Product: 365.1451690484178

Labels:
- Claim Label 101: 0
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 0
- Label 101 Adjusted: 0

Dataset: test