Methods for identifying malicious software

A method for identifying malicious software in an executable file, comprising:

• disassembling a portion of the executable file into instructions;
• dividing the portion into a plurality of windows, each window of the plurality of windows comprising one or more instructions;
• applying to the one or more instructions of the plurality of windows a transformation function that provides a numerically comparable value for the each window and results in a list of numerically comparable values for the plurality of windows;
• determining if a value from the list is a statistical outlier with respect to other values from the list;
• and
• if the value is a statistical outlier, identifying a window comprising the value as the malicious software,
• wherein the statistical outlier has a value two standard deviations greater than the mean of the list.

A method for identifying malicious software in an executable file, comprising:

• dividing a portion of the executable file into a plurality of windows, each window containing one or more bytes;
• applying to the one or more bytes in the plurality of windows a transformation function that provides a numerically comparable value for the each window;
• using information resulting from the applying a transformation function to compute a probability that a given one of the one or more bytes is malicious software
• determining if a given numerical comparable value is a statistical outlier with respect to other numerical comparable values;
• and
• if the given numerical comparable value is a statistical outlier, identifying a window comprising the given numerical comparable value as the malicious software,
• wherein the statistical outlier has a value two standard deviations greater than the mean of the numerical comparable values.