Techniques for Identifying Computer Virus Variant

A method of identifying software virus variants comprising:

• recording an API call sequence for a virus sample;
• comparing the API call sequence of the virus sample to characteristic API call sequences of virus families to determine matches between the API call sequence of the virus sample and the characteristic API call sequences of the virus families;
• determining that the virus sample is a virus variant when matches between the API call sequence of the virus sample and one or more of the characteristic API call sequences of the virus families reach a first rate;
• comparing the API call sequence of the virus sample to key API call sequences of the virus families to determine matches between the API call sequence of the virus sample and the key API call sequences of the virus families;
• and
• determining that the virus sample can be a virus variant when matches between the API call sequence of the virus sample and one or more of the key API call sequences of the virus families reach a second rate.