Method and system for discovering large clusters of files that share similar code to develop generic detections of malware

An article of manufacture, comprising:

• a computer readable medium;
• and
• computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
• determine a plurality of subsequences of operation codes in a plurality of disassembled system executable objects;
• for each subsequence, determine a first set of system executable objects associated with the subsequence;
• and
• merge the first set of system executable objects with a cluster, the cluster comprising a second set of system executable objects, wherein:
• causing the processor to merge the first set of system executable objects and the cluster comprises further causing the processor to:
• determine the relative similarity between the first set of system executable objects and the cluster;
• and
• if the first set of system executable objects is similar to the cluster, add the system executable objects to the cluster.

A system comprising:

• a processor;
• a computer readable medium;
• and
• computer-executable instructions carried on the computer readable medium, the instructions readable by the processor, the instructions, when read and executed, for causing the processor to:
• determine a plurality of subsequences of operation codes in a plurality of disassembled system executable objects;
• for each subsequence, determine a first set of system executable objects associated with the subsequence;
• and
• merge the first set of system executable objects with a cluster, the cluster comprising a second set of system executable objects, wherein:
• causing the processor to merge the first set of system executable objects and the cluster comprises further causing the processor to:
• determine the relative similarity between the first set of system executable objects and the cluster;
• and
• if the first set of system executable objects is similar to the cluster, add the system executable objects to the cluster.