Patent ID: 8413235
Filing Date: 2013-04-02
Classification: G06F

Abstract:
1. A computer-implemented method of using heritage data to detect malicious software (malware), the method comprising: receiving heritage data reports from a plurality of clients, the heritage data reports containing heritage data describing parent files detected at the clients and child files created by the parent files at the clients; aggregating the heritage data in the heritage data reports from the plurality of clients; analyzing the aggregated heritage data to categorize a parent file described by the heritage data as an expected executable file creator or an executable file creator of interest based on a typical behavior of the parent file as described by the aggregated heritage data, wherein the parent file is categorized as an executable file creator of interest responsive to a determination that it is anomalous for the parent file to create an executable child file; and reporting the categorization of the parent file to the plurality of clients; wherein the clients are adapted to use the categorization of the parent file to detect malware at the clients.