US 11,947,572 B2
Method and system for clustering executable files
Ilia Sergeevich Pomerantsev, Moscow Region (RU)
Assigned to GROUP IB TDS, LTD, Moscow (RU)
Filed by F.A.C.C.T. NETWORK SECURITY LLC, Moscow (RU)
Filed on Sep. 27, 2021, as Appl. No. 17/486,428.
Claims priority of application No. 2021108261 (RU), filed on Mar. 29, 2021.
Prior Publication US 2022/0309077 A1, Sep. 29, 2022
Int. Cl. G06F 16/00 (2019.01); G06F 16/11 (2019.01); G06F 16/28 (2019.01)
CPC G06F 16/285 (2019.01) [G06F 16/116 (2019.01)] 18 Claims
OG exemplary drawing
 
1. A method for clustering executable files, the method comprising:
obtaining, by the computer device, a plurality of executable files;
determining a file format of each executable file of the plurality of executable files;
for each file format:
(i) detecting, by the computer device, repeat sequences of commands of a predetermined length in a given executable file of the plurality of executable files,
a given command being represented by a portion of one of a source and machine code associated with the given executable file that includes an action to be executed by the given executable file;
(ii) determining, by the computer device, at least one frequently occurring sequence of the repeat sequences of commands in the given one of the plurality of executable files; and
based on the at least one frequently occurring sequence of commands, attributing the given executable file to a respective family;
iteratively executing the detecting, the determining, and the attributing until one of: all of the plurality of executable files are attributed to at least one respective family, and until un-attributed files of the plurality of executable files do not contain any repeat sequences of commands; and
in response to presence of un-attributed files of the plurality of executable files, attributing each of the un-attributed files of the plurality of executable files to a separate family.