A method of detecting malicious binary executable files is accomplished by inputting a binary executable file; converting the binary executable file to byte hexadecimal text strings; calculating the frequency of each byte pattern in the byte hexadecimal text strings; selecting characteristic byte pattern frequencies as discriminating features; classifying the discriminating features as malicious or benign; labeling the binary executable file as malicious or benign; and outputting the labeled malicious or benign binary executable file.
The present invention generally relates to computer protection, and, more specifically to anti-virus protection for computers that has a high detection rate and a very low false-positive alarm rate. This invention was made with Government support under Contract No. W-7405-ENG-36 awarded by the U.S. Department of Energy. The Government has certain rights in the invention.