Patent ID: 8769693
Filing Date: 2014-07-01
Classification: G06F

Abstract:
1. A method implemented on a computer having at least one processor, comprising: detecting an installation process installing an installation package; during installation of the installation package by the installation process, analyzing whether a combination of the installation process and the installation package, as a pair, has a trust reputation without scanning the installation package for malware; upon determining that the combination of the installation process and the installation package, as a pair, have a trust reputation, intercepting the installation process installing a first file of the installation package to analyze whether a combination of the first file and the installation process, as a pair, has a trust reputation without scanning the first file for malware; and upon determining that the combination of the first file and the installation process as a pair has a trust reputation, storing an identity associated with the first file in a persistent cache, wherein the persistent cache includes identities of files having a trust reputation.