Abstract: The present invention provides a method of reducing the amount of memory required to scan a given data string for the presence of computer viruses or other data traits of interest including the steps of 1) loading into a memory of a computer a set of generic features that are functionally similar to standard computer virus signatures, but tend to be less specific to particular viruses, 2) locating occurrences of the generic features within the data string, 3) applying a first mapping from the occurrences located during step 2) to obtain a subset of standard signatures, 4) loading the subset of standard signatures into a memory of said computer, 5) locating occurrences within the data string of all signatures from the subset of standard signatures, and 6) applying a second mapping from the occurrences located during step 5) to identify a set of computer viruses that are likely to be present in the data string.