Methods and systems for securing computer systems or networks against suspect binary files

A computer-implemented method of automatically securing a computer system or network against a suspect binary file (SBF) by, in response to detection of the SBF, initiating an automatic defense strategy including an action known to mitigate a known threat posed by a closest known malicious binary file (KMBF), the method comprising:

• identifying the closest KMBF from a plurality of KMBFs by comparing an SBF application programming interface (API) profile generated in respect of the SBF with respective KMBF API profiles generated in respect of each of the plurality of KMBFs, the SBF API profile and the KMBF API profiles being generated by:
• identifying any API calls in the respective binary file,
• assigning each of the identified API calls to one of a plurality of API call categories defined by one or more actions known to be effective in mitigating one or more possible threats posed by the respective API call category,
• counting the number of API calls of the SBF assigned to each of the API call categories,
• counting the number of API calls of the KMBF assigned to each of the API call categories, and
• for each of the KMBFs:
• allocating each of the API call categories an API call category matching score according to how close the number of API calls of the SBF assigned to that category is to the number of API calls of the KMBF assigned to that category, and
• allocating the KMBF an API profile matching score with respect to the SBF by combining all of the API call category matching scores,
• wherein the closest KMBF is identified as the one of the plurality of KMBFs with a highest API profile matching score.