Abstract: A method for identifying a data collection as malware, comprising the steps of parsing the data collection to generate program code and to verify conformance to a language syntax, emulating the interaction between the program code and a processor, detecting presence of a portion of the program code that is likely to have been added to the program code for the purpose of avoiding detection by malware detection programs, and, in the presence of such code, identifying the data collection as malware. According to the present invention, the emulation of the processor is focused on identifying code that has been added to a data collection to avoid detection by existing malware detection programs. An advantage with basing a malware assessment on the presence of such “suspicious” code, is that the emulation required to identify suspicious code typically is much less complicated than emulation required to identify malicious behavior in the actual malware code.

Abstract: A method for automatically generating a genetic signature for a set of malware, comprising parsing (step S11) the malware to identify a set of binary comparable features present in said malware, storing (step S5; step S11) all binary comparable features occurring in said set of malware, determining (step S13, S14) a subset comprising binary comparable features occurring in at least a predetermined portion of all malware in the set, and including (step S15) representations of the binary comparable features in the subset in the genetic signature. Compared to prior art systems, the genetic signature according to the present invention is unique in that it does not rely on relationships between individual features, only on their occurrence in various malware in the set. A genetic signature according to the present invention may for example consist of associations to five different features which have no relation to each other at all.