Santos Grueiro, IgorPeña Landaburu, Yoseba KoldobikaDevesa Esteban, JaimeGarcía Bringas, Pablo2026-10-142026-10-142009Santos, I., Penya, Y. K., Devesa, J., & Bringas, P. G. (2009). N-grams-based file signatures for malware detection. ICEIS 2009 - 11th International Conference on Enterprise Information Systems, Proceedings, AIDSS, 317-320. https://doi.org/10.5220/0001863603170320978989811184510.5220/0001863603170320https://hdl.handle.net/20.500.14454/6790Ponencia presentada en la 11ª International Conference on Enterprise Information Systems (ICEIS 2009), celebrado/a en Milán entre el 6 y el 10 de mayo de 2009.Malware is any malicious code that has the potential to harm any computer or network. The amount of malware is increasing faster every year and poses a serious security threat. Thus, malware detection is a critical topic in computer security. Currently, signature-based detection is the most extended method for detecting malware. Although this method is still used on most popular commercial computer antivirus software, it can only achieve detection once the virus has already caused damage and it is registered. Therefore, it fails to detect new malware. Applying a methodology proven successful in similar problem-domains, we propose the use of n-grams (every substring of a larger string, of a fixed lenght n) as file signatures in order to detect unknown malware whilst keeping low false positive ratio. We show that n-grams signatures provide an effective way to detect unknown malware.eng© SciTePressSecurityComputer virusesData-miningMalware detectionMachine learningconference paper2026-10-14