	US 12,265,619 B2
	Optimal antimalware signatures database
Andrey Kulaga, Moscow (RU); Serguei Beloussov, Singapore (SG); and Stanislav Protasov, Singapore (SG)
Assigned to Acronis International GmbH, Schaffhausen (CH)
Filed by Acronis International GmbH, Schaffhausen (CH)
Filed on Mar. 28, 2022, as Appl. No. 17/656,876.
Prior Publication US 2023/0306115 A1, Sep. 28, 2023
Int. Cl. G06F 21/56 (2013.01)

CPC G06F 21/566 (2013.01) [G06F 21/565 (2013.01); G06F 2221/034 (2013.01)]

20 Claims

1. A method for creating an exportable digital collection of optimized malware family-specific signatures for protecting a computing system from malware, the method comprising:

providing a sample of files comprising known clean files and known malware files;

wherein the known clean files and malware files comprise a plurality of attribute vectors;

identifying signatures for the plurality of attribute vectors;

calculating, for each signature from among the signatures, a false positive rate by identifying the number of clean files with each said signature, and grouping malware files that share a signature in a family cluster;

from all the signatures in the family cluster, selecting a signature with the lowest false positive rate as a representative signature for the family cluster, wherein the representative signature is a first signature and a second representative signature is selected and wherein the second representative signature is selected using a predefined target function, wherein the predefined target function selects, as the second representative signature, the signature with the greatest probability to be found among all samples of the malware family cluster; and

exporting the representative signature configured for use by a scan engine.

2. The method according to claim 1, wherein the predefined target function selects, as a second representative signature, the signature with the second lowest false positive rate and the greatest probability to be found among all samples of the malware family cluster.

3. The method according to claim 2, wherein the predefined target function further selects, as a third representative signature, the signature that requires the least amount of resources to scan a file for the signature.

4. The method according to claim 1, wherein the predefined target function further selects, as a second representative signature, the signature that requires the least amount of resources to scan a file for the signature.

5. The method according to claim 1, wherein the predefined target function further selects as a third representative signature, the signature that requires the least amount of resources to scan a file for the signature.