This article proposes the problem of the anti-virus heuristic analysis. Important feature of static heuristic techniques is dependence of indicators of detection on structure of the training set. Offered the technique of formation a training set . Concepts of a measure of similarity and a matrix of similarity were entered. The measure of similarity shows degree of compliance of one file to another. The matrix of similarity consists of measures of similarity of files of the training set. With use of the entered definitions the technique of formation of the training selection was developed. The main idea of a technique consists what the files which remained in the training set had as it is possible a smaller measure of similarity with the others. The carried-out experimental inspection showed efficiency and the practical importance of the proposed solution.

Keywords: information security, virus protection, heuristic analysis, machine learning, training set, malwares