Patent ID: 9613213
Date: 2017-04-04
CPC Classifications: G06F,H04L

Claim:
1. A computer-implemented method of providing malicious software (malware) definitions to clients, wherein the clients are electronic devices, comprising: receiving telemetry data from a plurality of clients, the telemetry data describing files created on the clients; analyzing the telemetry data to identify malware that is currently spreading among the plurality of clients, the analysis based at least in part on whether a particular type of malware is detected on a threshold number of clients within a predetermined time period and an amount of damage caused by the particular type of malware; identifying a subset of a set of cloud malware definitions responsive to the analysis of the telemetry data, the identified subset containing malware definitions for malware identified as currently spreading among the plurality of clients; and providing the identified subset of the cloud malware definitions as a set of local malware definitions to the plurality of clients, wherein the plurality of clients are adapted to store the local malware definitions and use the set of local malware definitions to detect malware at the clients.