Patent ID: 8918877
Filing Date: 2014-12-23
Classification: G06F

Abstract:
1. A system, comprising: a set of one or more interfaces configured to: receive from a first source a first set of malware signatures at a first time and, at a second time that is later than the first time, receive from the first source an updated first set of malware signatures; receive from a second source different from the first source a second set of malware signatures that is different from the first set of malware signatures and different from the updated first set of malware signatures; a set of one or more processors configured to: compile the received first set of malware signatures and load a compiled first set into a first allocated area of RAM at a first time; compile the received second set of malware signatures at a second time that is different from the first time and load a compiled second set into a second allocated area of RAM that is different from the first allocated area of RAM; load a recompiled first set into the first allocated area of RAM, wherein the recompiled first set is created by compiling the updated first set of malware signatures; and determine whether a file is malicious at least in part by performing a scan using at least one of: information stored in the first and second respective allocated areas of RAM; and a memory coupled to the processor and configured to provide the processor with instructions.