# US 9,519,780 B1 · Systems and methods for identifying malware > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,780 B1 - Document ID: US9519780B1 - Status: Granted - Kind: B1 - Application number: 14/570,393 - Filed: 2014-12-15 - Granted: 2016-12-13 - Earliest claimed: 2014-12-15 - Assignees: Symantec Corporation - Applicants: Symantec Corporation - Inventors: Jiang Dong - Web page: https://patentgrep.com/patent/US9519780B1 ## CPC - G06F 21/564: {by virus signature recognition} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A computer-implemented method for identifying malware may include (1) determining, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command, (2) filtering, based on the determination, invocation commands from the bytecode, (3) adding, for each invocation command filtered from the bytecode, an opcode, a format code, and a function prototype to a collection of opcodes, format codes, and function prototypes, (4) generating a digital fingerprint of the collection including the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, and (5) performing, by a computer security system, a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that the digital fingerprint matches a candidate instance of bytecode under evaluation. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for identifying malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: determining, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command; filtering, based on the determination, invocation commands from the bytecode; adding, for each invocation command filtered from the bytecode, a concatenation comprising an opcode, a format code, and a function prototype to a collection of concatenations comprising opcodes, format codes, and function prototypes; generating at least two digital fingerprints based on the collection of the concatenations comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, the at least two digital fingerprints comprising at least two of: a digital fingerprint of the collection after executing an ordering algorithm on the collection; a digital fingerprint of the collection without executing the ordering algorithm; a digital fingerprint of a prefix of the collection; and a digital fingerprint of a suffix of the collection; and performing, by a computer security system, a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that a candidate instance of bytecode under evaluation matches at least one of the at least two generated digital fingerprints. ### Claim 2 (depends on 1) The method of claim 1, wherein filtering, based on the determination, invocation commands from the bytecode comprises excluding, through the filtering, at least one non-invocation command based on a determination that the non-invocation command does not constitute an invocation command. ### Claim 3 (depends on 2) The method of claim 2, wherein filtering, based on the determination, invocation commands from the bytecode comprises excluding, through the filtering, a plurality of non-invocation commands based on a determination that each non-invocation command in the plurality does not constitute an invocation command. ### Claim 4 (depends on 3) The method of claim 3, wherein filtering, based on the determination, invocation commands from the bytecode comprises excluding, through the filtering, each non-invocation command in the bytecode associated with the malware program based on a determination that each non-invocation command in the bytecode does not constitute an invocation command. ### Claim 5 (depends on 1) The method of claim 1, wherein the opcode identifies a type of the invocation command. ### Claim 6 (depends on 1) The method of claim 1, wherein the function prototype identifies at least one of: a number and type of parameters passed to a function through the invocation command; and a number and type of return values returned by the function after invoking its execution through the invocation command. ### Claim 7 (depends on 1) The method of claim 1, wherein the format code specifies information that describes the format of the invocation command. ### Claim 8 (depends on 7) The method of claim 7, wherein the format code specifies: an argument word count for the invocation command; and information describing registers used by the invocation command. ### Claim 9 (depends on 1) The method of claim 1, further comprising: adding a function prototype for the bytecode associated with the malware program to the collection prior to generating the at least two digital fingerprints, wherein generating the at least two digital fingerprints is performed based on the collection that includes the added function prototype for the bytecode in addition to the opcode, the format code, and the function prototype for each invocation command within the bytecode. ### Claim 10 (depends on 1) The method of claim 1, wherein the at least two digital fingerprints include the digital fingerprint of the collection after executing the ordering algorithm on the collection. ### Claim 11 (depends on 1) The method of claim 1, wherein the at least two digital fingerprints include the digital fingerprint of the suffix of the collection. ### Claim 12 (depends on 11) The method of claim 11, wherein the at least two digital fingerprints include the digital fingerprint of the prefix of the collection. ### Claim 13 (depends on 11) The method of claim 11, wherein the bytecode comprises SMALI code. ### Claim 14 (depends on 1) The method of claim 1, wherein at least one of the digital fingerprints comprises a cryptographic hash of the collection comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode. ### Claim 15 A system for identifying malware, the system comprising: a determination module, stored in memory, that determines, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command; a filtration module, stored in memory, that filters, based on the determination, invocation commands from the bytecode; an addition module, stored in memory, that adds, for each invocation command filtered from the bytecode, a concatenation comprising an opcode, a format code, and a function prototype to a collection of concatenations comprising opcodes, format codes, and function prototypes; a generation module, stored in memory, that generates at least two digital fingerprints based on the collection of the concatenations comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, the at least two digital fingerprints comprising at least two of: a digital fingerprint of the collection after executing an ordering algorithm on the collection; a digital fingerprint of the collection without executing the ordering algorithm; a digital fingerprint of a prefix of the collection; and a digital fingerprint of a suffix of the collection; a performance module, stored in memory, that performs a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that a candidate instance of bytecode under evaluation matches at least one of the at least two generated digital fingerprints; and at least one physical processor configured to execute the determination module, the filtration module, the addition module, the generation module, and the performance module. ### Claim 16 (depends on 15) The system of claim 15, wherein the filtration module filters, based on the determination, invocation commands from the bytecode at least in part by excluding, through the filtering, at least one non-invocation command based on a determination that the non-invocation command does not constitute an invocation command. ### Claim 17 (depends on 16) The system of claim 16, wherein the filtration module filters, based on the determination, invocation commands from the bytecode at least in part by excluding, through the filtering, a plurality of non-invocation commands based on a determination that each non-invocation command in the plurality does not constitute an invocation command. ### Claim 18 (depends on 17) The system of claim 17, wherein the filtration module filters, based on the determination, invocation commands from the bytecode at least in part by excluding, through the filtering, each non-invocation command in the bytecode associated with the malware program based on a determination that each non-invocation command in the bytecode does not constitute an invocation command. ### Claim 19 (depends on 15) The system of claim 15, wherein the opcode identifies a type of the invocation command. ### Claim 20 A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: determine, for multiple commands within bytecode associated with a malware program, whether each command constitutes an invocation command; filter, based on the determination, invocation commands from the bytecode; add, for each invocation command filtered from the bytecode, a concatenation comprising an opcode, a format code, and a function prototype to a collection of concatenations comprising opcodes, format codes, and function prototypes; generate at least two digital fingerprints based on the collection of the concatenations comprising the opcode, the format code, and the function prototype for each invocation command filtered from the bytecode, the at least two digital fingerprints comprising at least two of: a digital fingerprint of the collection after executing an ordering algorithm on the collection; a digital fingerprint of the collection without executing the ordering algorithm; a digital fingerprint of a prefix of the collection; and a digital fingerprint of a suffix of the collection; and perform, by a computer security system, a remedial action to protect a user in response to detecting the presence of a variant of the malware program by determining that a candidate instance of bytecode under evaluation matches at least one of the at least two generated digital fingerprints.