Patent ID: 9619649
Date: 2017-04-11
CPC Classifications: G06F

Claim:
1. A computer-implemented method for detecting potentially malicious applications, at least a portion of the method being performed by a computing system comprising at least one computer processor, the method comprising: detecting a request issued by an application running on a client device to download a file from a remote device; determining that the request calls an Application Programming Interface (API) that enables the client device to download the file from the remote device; identifying at least one parameter passed to the API in the request; sending the parameter to a security server for a security analysis; receiving, from the security server, information that indicates that the parameter has been implicated in a previous attempt to download a known malicious file, wherein the security server creates the information by: determining, based at least in part on the information received from the security server, that the parameter has been implicated in a previous attempt to download a known malicious file; and classifying, in response to determining that the parameter has been implicated in a previous attempt to download a known malicious file, the application that issued the request as potentially malicious.