20. Apparatus for obtaining a valid signature of an undesirable software entity, comprising: a memory for storing a corpus of computer programs that are representative of computer programs that are likely to be infected by an undesirable software entity; means for inputting and for storing in the memory at least one portion of an undesirable software entity, the at least one portion including a sequence of bytes of the undesirable software entity that is likely to remain substantially invariant from a first instance of the undesirable software entity to a second instance of the undesirable software entity; a first circuit for selecting at least one candidate signature of the undesirable software entity from the at least one portion of the undesirable software entity that is likely to remain substantially invariant, said first circuit including means for accessing the stored at least one portion of the undesirable software entity to identify the sequence of bytes of the undesirable software entity that are likely to remain substantially invariant; a second circuit for constructing a list of unique n-grams, each of the unique n-grams being comprised of from one to n sequential bytes of the sequence of bytes; a third circuit for estimating, for each of the unique n-grams, a probability of an occurrence of a unique n-gram within sequences of bytes obtained from said stored corpus of computer programs; a fourth circuit for estimating, for each candidate signature that is comprised of one or more of the unique n-grams, a probability of an occurrence of the candidate signature within the sequences of bytes obtained from the corpus of computer programs; a fifth circuit for comparing candidate signatures with one another and with a set threshold probabilities, the threshold probabilities having a value selected to reduce a likelihood of an occurrence of a false positive indication during the use of a signature; and circuit means for outputting at least one signature for subsequent use in identifying an occurrence of the undesirable software entity or a modified version of the undesirable software entity, the outputted at least one signature being determined to exhibit a false alarm probability that is comparable to or less than a lowest false alarm probability of others of the candidate signatures.
20. Apparatus for obtaining a valid signature of an undesirable software entity, comprising: a memory for storing a corpus of computer programs that are representative of computer programs that are likely to be infected by an undesirable software entity; means for inputting and for storing in the memory at least one portion of an undesirable software entity, the at least one portion including a sequence of bytes of the undesirable software entity that is likely to remain substantially invariant from a first instance of the undesirable software entity to a second instance of the undesirable software entity; a first circuit for selecting at least one candidate signature of the undesirable software entity from the at least one portion of the undesirable software entity that is likely to remain substantially invariant, said first circuit including means for accessing the stored at least one portion of the undesirable software entity to identify the sequence of bytes of the undesirable software entity that are likely to remain substantially invariant; a second circuit for constructing a list of unique n-grams, each of the unique n-grams being comprised of from one to n sequential bytes of the sequence of bytes; a third circuit for estimating, for each of the unique n-grams, a probability of an occurrence of a unique n-gram within sequences of bytes obtained from said stored corpus of computer programs; a fourth circuit for estimating, for each candidate signature that is comprised of one or more of the unique n-grams, a probability of an occurrence of the candidate signature within the sequences of bytes obtained from the corpus of computer programs; a fifth circuit for comparing candidate signatures with one another and with a set threshold probabilities, the threshold probabilities having a value selected to reduce a likelihood of an occurrence of a false positive indication during the use of a signature; and circuit means for outputting at least one signature for subsequent use in identifying an occurrence of the undesirable software entity or a modified version of the undesirable software entity, the outputted at least one signature being determined to exhibit a false alarm probability that is comparable to or less than a lowest false alarm probability of others of the candidate signatures. 23. Apparatus as set forth in claim 20 wherein said third circuit for estimating a probability of an occurrence of a unique n-gram is coupled to said memory having stored therein a predetermined table of probabilities of the occurrence of an n-gram within the sequences of bytes obtained from the corpus of computer programs.