Executable File Clustering via Command Sequence Analysis

The patent segments the malware analysis into multiple components: extracting various features (static, dynamic, behavioral), dividing the detection process into multiple stages, and breaking down the malware into functional components for analysis. This segmentation allows the system to analyze different aspects of malware independently and combine results for more robust detection that is less susceptible to evasion techniques.

The patent employs parameter changes by analyzing multiple features and characteristics of malware beyond simple signatures. It extracts and analyzes various parameters including file structure, behavioral patterns, execution characteristics, and statistical features. By changing from single-parameter signature matching to multi-parameter analysis, the system achieves better detection accuracy while maintaining resistance to malware modification and obfuscation.

The patent applies preliminary action by pre-extracting and storing multiple features and characteristics of malware samples before actual detection occurs. It pre-processes malware to extract static features, prepares dynamic analysis templates, and pre-computes various metrics. This preliminary preparation ensures that even when malware is modified or obfuscated, the pre-extracted features and patterns can be quickly compared to identify affiliation relationships.

The patent implements universality by creating a multi-functional analysis system that can detect various types of malware using the same core methodology. The system extracts universal features that apply across different malware families and authors, enabling it to determine affiliation relationships regardless of the specific modification or obfuscation technique used. The same feature extraction and comparison framework works universally across diverse malware types.