Patent ID: 8336100
Filing Date: 2012-12-18
Classification: G06F

Abstract:
1. A computer-implemented method for using reputation data to detect packed malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a file; determining that the file has been packed; obtaining community-based reputation data for the file that identifies the file's prevalence within a community of users, wherein the reputation data for the file is based at least in part on information obtained from computing devices within the community of users; determining, by analyzing the reputation data for the file, that the file's prevalence within the community of users fails to satisfy a predetermined prevalence threshold; convicting the file as a security risk in response to determining both that the file has been packed and that the file's prevalence within the community of users fails to satisfy the predetermined prevalence threshold; performing a security operation on the file in response to convicting the file as a security risk.