Patent ID: 8701190
Filing Date: 2014-04-15
Classification: G06F

Abstract:
1. A computer-implemented method for detecting malicious computer files, comprising: generating a graph comprising nodes representing a plurality of clients and computer files residing thereon, wherein a node representing a client is connected to nodes representing computer files residing on that client through edges; determining priors for nodes in the graph and edge potentials for edges in the graph, wherein a prior for a node representing a client comprises an assessment of a likelihood of the client getting infected by malware, a prior for a node representing a computer file comprises an assessment of a likelihood of the computer file being malware, and an edge potential reflects a relationship between nodes connected by an associated edge, and wherein the priors for nodes in the graph and the edge potentials for edges in the graph are determined based on domain knowledge; propagating probabilities of computer files being legitimate among the nodes by transmitting messages along the edges in the graph; and determining whether a computer file is classified as malicious based on a probability associated with a corresponding node in the graph.