Patent ID: 11941122
Assignee: UAB 360 IT
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A method for detecting malware in files, the method comprising:
determining a first probability that a file stored on a computing device is malware using a first malware model by the computing device;
based on the determined first probability, determining a malware status of the file by the computing device, wherein the malware status is one of malware, not malware, or inconclusive by;
if the first probability is below a first threshold and below a second threshold, determining that the malware status is not malware;
if the first probability is above the first threshold and below the second threshold, determining that the malware status is inconclusive; and
if the probability is above the first threshold and above the second threshold, determining that the malware status is malware;

when the malware status of the file is inconclusive:
determining a second probability that the file is malware using a second malware model by the computing device;
providing at least a portion of the file and the second probability to the server through the network as training data for the first malware model; and
receiving an updated version of the first malware model from the server.