Patent ID: 9218461
Filing Date: 2015-12-22
Classification: G06F,H04L

Abstract:
1. A computer-implemented method for making a determination concerning whether a software application is benign or malicious comprising: extracting metadata about the application; gathering a first set of contextual information concerning the system to generate a constructed infection history for a client, wherein said first set of contextual information includes recent infection history, applications running on the system, web sites visited, the geographic location of the client, the Internet Protocol (IP) address of the client, and a client identifier; transmitting the metadata and the first set of contextual information to a server component, wherein the metadata and the first set of contextual information are encoded prior to the transmitting; making a determination as to whether the application is benign or malicious by: deriving a model based on the determination, the model encoding rules to be utilized in making future determinations when a second set of contextual information is similar to the first set of contextual information; transmitting a response to the client containing information relating to the determination; and making a determination as to whether to take any action concerning the application based on the information from the server component.