Method and system for rapid signature search over encrypted content

An article of manufacture, comprising:

• a computer readable medium;
• and
• computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
• divide data to be scanned for malware into at least a first data segment and a second data segment;
• divide a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment;
• perform a relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets;
• perform the relationship function on the first data segment and the second data segment, yielding a second result;
• compare the first result and the second result;
• based on the comparison, determine that the data includes information corresponding to the signature.

A system for detecting malware, comprising:

• a processor;
• a computer readable medium;
• and
• an anti-malware application configured to protect an electronic device from malware, the anti-malware application including instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the anti-malware application to:
• divide data to be scanned for malware into at least a first data segment and a second data segment;
• divide a signature corresponding to an indication of malware into at least a first signature segment and a second signature segment;
• perform a relationship function on the first signature segment and the second signature segment, yielding a first result, the relationship function characterizing the relationship between at least two information sets;
• perform the relationship function on the first data segment and the second data segment, yielding a second result;
• compare the first result and the second result;
• based on the comparison, determine that the data includes information corresponding to the signature.