| CPC G06F 21/564 (2013.01) [G06F 16/24578 (2019.01); G06F 2221/033 (2013.01)] | 20 Claims |
|
1. A computer-implemented method comprising:
obtaining a sample from a sample source;
generating a plurality of particles from the sample, wherein each particle from the plurality of particles is an array of unique bytes generated based on one or more particle properties, and wherein the generating comprises:
parsing the sample to identify a first array of bytes;
removing at least one repeating byte from the first array of bytes based on the one or more particle properties to generate a first array of unique bytes; and
compressing the first array of unique bytes to generate a first particle of the plurality of particles; and
determining whether the sample is associated with a known threat by comparing the plurality of particles to particle threat signatures in a threat database.
|