There are provided measures for enabling detecting malware. A method includes
generating a copy of a first node,
configuring a sandbox environment by using the generated copy,
executing an electronic file or a URL in the sandbox environment configured with the copy,
providing a result of the malware analysis of the electronic file or the URL,
identifying the electronic file or the URL as malicious or suspicious on the basis of the provided result, and
taking further action for protecting the first node from the electronic file or the URL identified as malicious or suspicious.
A system for identifying a work represented by digital data. This system detects events in data of the content of an unknown work and measures a metric between the events. The system then compares the detected events and metrics from an unknown work with the events and metrics of a known work.
If the events and metrics match, the unknown work is identified as a copy of the known work.