Binary search of byte sequences using inverted indices

A computing device comprising:

• one or more processors;
• and
• memory storing computer-executable instructions that, when executed by the one or more processors, perform operations comprising:
• for each byte sequence of a fixed length comprising a file, searching an inverted index which specifies byte sequences of the fixed length and, for each specified byte sequence, file identifiers of files that include the specified byte sequence, wherein each file identifier is associated with a security status;
• based on results of the search, creating a list of candidate byte sequences, wherein the candidate byte sequences are only found in files with file identifiers that are associated with a malware status or an unknown status;
• selecting ones of the candidate byte sequences that are associated with the greatest numbers of file identifiers;
• and
• generating a signature from the selected ones of the candidate byte sequences.

One or more non-transitory computer-readable media having stored thereon programming instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

• for each byte sequence of a fixed length comprising a file, searching an inverted index which specifies byte sequences of the fixed length and, for each specified byte sequence, file identifiers of files that include the specified byte sequence, wherein each file identifier is associated with a security status;
• based on results of the search, creating a list of candidate byte sequences, wherein the candidate byte sequences are only found in files with file identifiers that are associated with a malware status or an unknown status;
• selecting ones of the candidate byte sequences that are associated with the greatest numbers of file identifiers;
• and
• generating a signature from the selected ones of the candidate byte sequences.