Patent ID: 11941122
Assignee: UAB 360 IT
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 6:
7. A system for detecting malware in files, the system comprising:
at least one computing device; and
a computer-readable medium storing computer-executable instructions that when executed by the at least one computing device cause the at least one computing device to:
determine a first probability that a file stored on the at least one computing device is malware using a first malware model;
based on the determined first probability, determine a malware status of the file, wherein the malware status is one of malware, not malware, or inconclusive by:
if the first probability is below a first threshold and below a second threshold, determining that the malware status is not malware;
if the first probability is above the first threshold and below the second threshold, determining that the malware status is inconclusive; and
if the probability is above the first threshold and above the second threshold, determining that the malware status is malware;

when the malware status of the file is inconclusive:
determine a second probability that the file is malware using a second malware model;
provide at least a portion of the file and the second probability to the server through the network as training data for the first malware model; and
receive an updated version of the first malware model from the server.