Abstract: A malware detection/identification system scores each subject file and/or scores ‘tags’ obtained from the subject file to determine the potential that the file contains malicious components. A file or tag score tending to indicate that the subject file may contain malicious components/properties/attributes, may be used to notify the system (and a user of the system) that the file may be potentially malicious, so that the file may be quarantined and subject to further analysis. Embodiments of the current disclosure utilize a database structure that contains multitudes (e.g., hundreds, thousands, or even millions) of “tags” that have been pulled from known malicious and known benign sample files, where the database provides many-to-many relations between the known sample files and the tags.

Abstract: Systems and methods generate and apply identification codes or “fingerprints” with respect to software functions contained in executable files. Utilizing such fingerprinting procedures, the function identification codes for known malicious files and/or known benign can be stored in the database. Subsequently, received files can be processed in the same manner and the function identification codes generated for the received files can be compared against the function identification codes for the known malicious files and/or known benign files in the database to determine a level of similarity between the functions of received executable files and those of known categorized executable files in the database. This can be used to determine whether a received file is malicious or benign along with a score describing the confidence in that determination.

Abstract: A malware detection/identification system scores each subject file and/or scores ‘tags’ obtained from the subject file to determine the potential that the file contains malicious components. A file or tag score tending to indicate that the subject file may contain malicious components/properties/attributes, may be used to notify the system (and a user of the system) that the file may be potentially malicious, so that the file may be quarantined and subject to further analysis. Embodiments of the current disclosure utilize a database structure that contains multitudes (e.g., hundreds, thousands, or even millions) of “tags” that have been pulled from known malicious and known benign sample files, where the database provides many-to-many relations between the known sample files and the tags.