26. A method for operating a digital data processor to obtain one or more valid signatures of an undesirable software entity, the digital data processor including a memory that is bidirectionally coupled to the digital data processor, the method comprising the steps of: storing in the memory a corpus of computer programs that are representative of computer programs that are likely to be infected by an undesirable software entity; inputting to the digital data processor at least one portion of the undesirable software entity, the at least one portion including a sequence of bytes of the undesirable software entity that are likely to remain substantially invariant from a first instance of the undesirable software entity to a second instance of the undesirable software entity; storing the at least one inputted portion in the memory; selecting at least one candidate signature of the undesirable software entity from the stored at least one portion of the undesirable software entity; constructing with the digital data processor a list of unique n-grams from the sequence of bytes, the constructed list being stored in the memory; for each of the unique n-grams of the stored list, estimating with the digital data processor a probability of an occurrence of the unique n-gram within sequences of bytes obtained from the stored corpus of computer programs; for each candidate signature that is comprised of one or more of the unique n-grams, estimating with the digital data processor a false-positive probability of an occurrence of the candidate signature within the sequences of bytes obtained from the corpus of computer programs; and comparing the estimated false-positive probabilities of the candidate signatures with one another and with a set of threshold probabilities, the threshold probabilities having values selected to reduce a likelihood of an occurrence of a false positive indication during the use of any signature with a false-positive probability less than the threshold, the step of comparing including the steps of, discarding any candidate signatures for which an occurrence of a predetermined number of selected bytes is more common than a predetermined threshold; evaluating an exact-match probability for all remaining candidate signatures; discarding any candidate signatures having an exact-match false positive probability that is above an exact-match threshold; retaining n candidate signatures having the lowest estimated probabilities; for each remaining candidate signature i, evaluating a fragment false positive probability frag.sub.i ; for each remaining candidate signature i, also evaluating an m-mismatch false positive probability, starting with m=1, and incrementing m until the false positive probability exceeds an m-mismatch threshold; EQU setting M.sub.i =m-1; for all candidate signatures that correspond to a particular undesirable software entity, choosing as a best signature the signature having a largest value of M; and recording a chosen best signature for each undesirable software entity in a signature database for subsequent use in identifying an occurrence of the undesirable software entity or a modified version of the undesirable software entity.
26. A method for operating a digital data processor to obtain one or more valid signatures of an undesirable software entity, the digital data processor including a memory that is bidirectionally coupled to the digital data processor, the method comprising the steps of: storing in the memory a corpus of computer programs that are representative of computer programs that are likely to be infected by an undesirable software entity; inputting to the digital data processor at least one portion of the undesirable software entity, the at least one portion including a sequence of bytes of the undesirable software entity that are likely to remain substantially invariant from a first instance of the undesirable software entity to a second instance of the undesirable software entity; storing the at least one inputted portion in the memory; selecting at least one candidate signature of the undesirable software entity from the stored at least one portion of the undesirable software entity; constructing with the digital data processor a list of unique n-grams from the sequence of bytes, the constructed list being stored in the memory; for each of the unique n-grams of the stored list, estimating with the digital data processor a probability of an occurrence of the unique n-gram within sequences of bytes obtained from the stored corpus of computer programs; for each candidate signature that is comprised of one or more of the unique n-grams, estimating with the digital data processor a false-positive probability of an occurrence of the candidate signature within the sequences of bytes obtained from the corpus of computer programs; and comparing the estimated false-positive probabilities of the candidate signatures with one another and with a set of threshold probabilities, the threshold probabilities having values selected to reduce a likelihood of an occurrence of a false positive indication during the use of any signature with a false-positive probability less than the threshold, the step of comparing including the steps of, discarding any candidate signatures for which an occurrence of a predetermined number of selected bytes is more common than a predetermined threshold; evaluating an exact-match probability for all remaining candidate signatures; discarding any candidate signatures having an exact-match false positive probability that is above an exact-match threshold; retaining n candidate signatures having the lowest estimated probabilities; for each remaining candidate signature i, evaluating a fragment false positive probability frag.sub.i ; for each remaining candidate signature i, also evaluating an m-mismatch false positive probability, starting with m=1, and incrementing m until the false positive probability exceeds an m-mismatch threshold; EQU setting M.sub.i =m-1; for all candidate signatures that correspond to a particular undesirable software entity, choosing as a best signature the signature having a largest value of M; and recording a chosen best signature for each undesirable software entity in a signature database for subsequent use in identifying an occurrence of the undesirable software entity or a modified version of the undesirable software entity. 30. A method as set forth in claim 26 wherein the step of recording includes a step of also recording in the signature database fragment matches that are to be permitted.