US Patent 11461468 Visual identification of malware

There is disclosed in one example a computing apparatus, including: a hardware platform including a processor and a memory; and instructions encoded within the memory to instruct the processor to: receive an unknown file object; select the unknown file object for visual analysis; compute first, second, and third property sets for the unknown object; and construct an n×m bitmap of pixels, including comparing the unknown file object to n×m known file objects, wherein the pixels include first, second, and third color channels, wherein the first, second, and third color channels represent similarity of the first, second, and third properties to corresponding first, second, and third properties of a known file object from among the n×m file objects.