# US 10,482,244 B1 · Systems and methods for efficiently matching files > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,244 B1 - Document ID: US10482244B1 - Status: Granted - Kind: B1 - Application number: 15/468,153 - Filed: 2017-03-24 - Granted: 2019-11-19 - Earliest claimed: 2017-03-24 - Assignees: Symantec Corporation - Applicants: Symantec Corporation - Inventors: Slawomir Grzonkowski; Piotr Krysiuk - Web page: https://patentgrep.com/patent/US10482244B1 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/563: {by source code analysis} - G06F 16/14: Details of searching files based on file metadata - G06F 16/148: {File search processing} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The disclosed computer-implemented method for efficiently matching files may include (i) analyzing a file to identify a set of functions within the file and relationships between functions within the set of functions, (ii) creating a set of representations for the set of functions by, for each function, combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function, (iii) comparing the set of representations of the set of functions with a set of representations of an additional set of functions identified within an additional file, and (iv) determining, based on comparing the sets of representations, that the file matches the additional file. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for efficiently matching files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: analyzing a file to identify a set of functions within the file and relationships between functions within the set of functions; creating a set of representations for the set of functions by, for each function within the set of functions; combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function; and combining a representation of a total number of instructions within a given function with a representation of the total number of instructions within each function identified as having the relationship to the given function; comparing a subset of the set of representations of the set of functions with a subset of a set of representations of an additional set of functions identified within an additional file; and determining, based on comparing the subset of the set of representations of the set of functions with the subset of the set of representations of the additional set of functions identified within the additional file, that the file matches the additional file. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising determining, based on determining that the file matches the additional file, that the file is malicious. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, further comprising performing a security action on the file in response to determining that the file is malicious. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein performing the security action comprises quarantining the file. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein analyzing the file to identify the set of functions within the file and the relationships between the set of functions comprises disassembling the file. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein identifying relationships between functions within the set of functions comprises identifying a calling relationship between a calling function within the set of functions and a called function within the set of functions by determining that the calling function calls the called function. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, creating the set of representations for the set of functions comprises: creating a string by appending, in a predetermined order, the representation of the size of each function identified, when analyzing the file, as having a relationship to the function to the representation of the size of the function; and hashing the string. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the representation of the size of the function comprises a measurement of the size of the function rounded to a nearest element of a predetermined numeric sequence that exhibits greater-than-linear growth. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein comparing the subset of the set of representations of the set of functions with the subset of the set of representations of the additional set of functions identified within the additional file comprises comparing the subset of the set of representations of the set of functions with a plurality of sets of representations of a plurality of sets of functions identified within a plurality of files stored in a library of comparison reference files. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein comparing the subset of the set of representations of the set of functions with the subset of the set of representations of the set of functions identified within the additional file comprises: training a machine learning classifier on a training set of data that comprises the set of representations of the set of functions; and using the machine learning classifier to compare the set of representations of the set of functions with the set of representations of the set of functions identified within the additional file. ### Claim 11 A system for efficiently matching files, the system comprising: an analysis module, stored in memory, that analyzes a file to identify a set of functions within the file and relationships between functions within the set of functions; a creation module, stored in memory, that creates a set of representations for the set of functions by, for each function within the set of functions; combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function; and combining a representation of a total number of instructions within a given function with a representation of the total number of instructions within each function identified as having the relationship to the given function; a comparison module, stored in memory, that compares a subset of the set of representations of the set of functions with a subset of a set of representations of an additional set of functions identified within an additional file; a determination module, stored in memory, that determines, based on comparing the subset of the set of representations of the set of functions with the subset of the set of representations of the additional set of functions identified within the additional file, that the file matches the additional file; and at least one physical processor configured to execute the analysis module, the creation module, the comparison module, and the determination module. ### Claim 12 (depends on 11) The system of claim 11, wherein the determination module determines, based on determining that the file matches the additional file, that the file is malicious. ### Claim 13 (depends on 12) The system of claim 12, wherein the determination module performs a security action on the file in response to determining that the file is malicious. ### Claim 14 (depends on 13) The system of claim 13, wherein the determination module performs the security action by quarantining the file. ### Claim 15 (depends on 11) The system of claim 11, wherein the analysis module analyzes the file to identify the set of functions within the file and the relationships between the set of functions by disassembling the file. ### Claim 16 (depends on 11) The system of claim 11, where the analysis module identifies relationships between functions within the set of functions by identifying a calling relationship between a calling function within the set of functions and a called function within the set of functions by determining that the calling function calls the called function. ### Claim 17 A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: analyze a file to identify a set of functions within the file and relationships between functions within the set of functions; create a set of representations for the set of functions by, for each function within the set of functions; combining a representation of a size of the function with a representation of a size of each function identified, when analyzing the file, as having a relationship to the function; and combining a representation of a total number of instructions within a given function with a representation of the total number of instructions within each function identified as having the relationship to the given function; compare a subset of the set of representations of the set of functions with a subset of a set of representations of an additional set of functions identified within an additional file; and determine, based on comparing the subset of the set of representations of the set of functions with the subset of the set of representations of the additional set of functions identified within the additional file, that the file matches the additional file.