Patent ID: 9202050
Filing Date: 2015-12-01
Classification: G06F

Abstract:
1. A computer-implemented method for detecting malicious files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: determining that a file previously stored on a client system is subject to a security assessment; based on determining that the file is subject to the security assessment, generating an initial fingerprint of the file on the client system, the generation of the initial fingerprint excluding at least a part of the file; sending, from the client system, the initial fingerprint to a server and receiving a response from the server comprising an indication that the initial fingerprint matches at least one known malicious file but that the file from which the initial fingerprint was generated may not match the malicious file; generating, in response to the indication, an additional fingerprint of the file on the client system based at least in part on the part of the file excluded in the generation of the initial fingerprint; sending, from the client system, the additional fingerprint to the server and receiving an additional response from the server indicating that the file on the client system is malicious; determining that a second file previously stored on the client system is subject to a second security assessment; based on determining that the second file is subject to the second security assessment, generating a second initial fingerprint of the second file on the client system, the generation of the second initial fingerprint excluding at least a second part of the second file; sending, from the client system, the second initial fingerprint to the server and receiving a second response from the server comprising a second indication that the second initial fingerprint matches at least one malicious file; determining, based on the second indication, despite the second part of the second file being excluded from the generation of the second initial fingerprint, and without generating a further fingerprint of the second file after generating the second initial fingerprint, that the second file on the client system is malicious.