Patent ID: 9332029
Filing Date: 2016-05-03
CPC Classification: G06F,H04L

Claim Text:
1. A method of distributed detection of malware, the method comprising: deploying a first security client on a first client computer, wherein the first security client is operable to identify and communicate with a plurality of second security clients deployed on respective second client computers; performing, by a hardware processor of the first client computer executing the first security client, a malware analysis of files on the first client computer; identifying metadata of an unknown file that could not be determined as either malicious or clean by the malware analysis; collecting, by the hardware processor executing the first security client, the metadata of the unknown file identified during the malware analysis of the unknown file by the first security client; multicasting, by the hardware processor executing the first security client, to the plurality of second client computers, a request that includes the metadata of the unknown file and a remediation tool for the unknown file; receiving responses from at least two of the plurality of second client computers, where the responses contain information relating to the unknown file; selecting, by the hardware processor of the first client computer, one of the at least two second client computers as a source client computer; receiving, from the source client computer, a copy of the unknown file, an identification of the unknown file as a malicious file and the malware remediation tool for the identified malicious file, wherein the remediation tool includes information, statistics data and malware repair or removal instructions for the malicious file; updating a local malware database on the first client computer with the identification of the unknown file as the malicious file and the malware remediation tool; and using, by the hardware processor executing the first security client, the malware remediation tool to repair the first client computer.