Methods and devices for detection of malware

A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the code comprising code to cause the processor to:

• define a vector data structure having a plurality of counters, each counter from the plurality of counters (1) having an index value and (2) storing a probabilistic count;
• identify a data feature within a file;
• transform the data feature to determine an index value associated with the data feature;
• access a counter from the plurality of counters based on the index value of the counter corresponding to the index value associated with the data feature;
• determine, based on a probability associated with the probabilistic count of the counter, whether to increment the probabilistic count of the counter;
• and
• generate a malware signature associated with the file based on the vector data structure.

A method, comprising:

• receiving a malicious file;
• extracting a data feature from the malicious file;
• transforming the data feature to determine an index value associated with the data feature;
• accessing, using the index value, a probabilistic counter associated with the data feature and from a plurality of probabilistic counters within a vector data structure associated with the malicious file;
• determine, based on a probability associated with a value of the probabilistic counter, whether to increment the value of the probabilistic counter;
• and
• generate a signature associated with the malicious file based on the vector data structure.