Patent ID: 9245123
Filing Date: 2016-01-26
CPC Classification: G06F,H04L

Claim Text:
1. A computer-implemented method for identifying malicious files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying different instances of a file that is subject to a security evaluation; identifying, within a field for each of the different instances, an attribute of the different instance that associates the different instance with a respective application; determining that the respective applications to which the different instances of the file are associated are distinct applications and are known to be safe by determining that at least a threshold number of the respective applications are distinct applications and are known to be safe; adjusting a security policy for the file, by increasing an estimation that the file is malicious, based on the determination that the respective applications are distinct applications and are known to be safe; classifying, in a software security system, the file as malicious based on the adjusted security policy that increased the estimation that the file is malicious.