Discovery of malicious strings

At least one non-transitory computer-readable medium comprising one or more instructions that when executed by at least one processor, cause the at least one processor to:

• determine a string of a data sample;
• perform an Internet search for the string;
• compare the results of the Internet search for the string with results of an Internet search for a known clean string;
• cluster, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string;
• and
• populate a dirty string database with the clustered strings.

An apparatus comprising:

• memory;
• and
• a hardware processor configured to:
• determine a string of a data sample;
• perform an Internet search for the string;
• compare the results of the Internet search for the string with results of an Internet search for a known clean string;
• cluster, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string;
• and
• populate a dirty string database with the clustered strings.

A method comprising:

• determining a string of a data sample;
• performing an Internet search for the string;
• comparing the results of the Internet search for the string with results of an Internet search for a known clean string;
• clustering, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string;
• and
• populating a dirty string database with the clustered strings.

A system for discovering malicious strings, the system comprising:

• memory;
• and
• a hardware processor configured for:
• determining a string of a data sample;
• performing an Internet search for the string;
• comparing the results of the Internet search for the string with results of an Internet search for a known clean string;
• clustering, based on a determination that the number of hits from the Internet search is not comparable to the number of hits from a known clean string search, the string with other strings having Internet search results that are not comparable to those of a known clean string;
• and
• populating a dirty string database with the clustered strings.