sign len ← 0 2: sign weak ← false 3: for sign len = 1 to 10 do 4: for all malicious seq ∈ obtained malware uid seqs do 5: if malicious seq[sign len] = normal seq[sign len] then 6: sign weak ← true 7: break 8: end if 9: end for 10: if not sign weak then 11: break 12: end if 13: end for 14: if not seq to test[sign len] = normal seq[sign len] then 15: return background event = true 16: else 17: return background event = false 18: end if