Patent ID: 9104872
Filing Date: 2015-08-11
Classification: G06F

Abstract:
1. A method comprising: (i) loading a plurality of known clean files into a volatile computer memory, the computer hashing the plurality of known clean files to generate a plurality of first hashes in a table; (ii) receiving a second hash of an unknown file, the second hash generated on an unknown system; (iii) storing the second hash in a nonvolatile memory; (iv) using a processor of the computer, comparing the plurality of first hashes in the table with the second hash to compute match scores, wherein the match scores are indicative of a relative degree to which the plurality of hashes in the table and the unknown file are similar to accommodate for trivial changes in the unknown file and wherein the match scores are determined using weights to reflect the severity of certain changes and wherein the weights are configured to be dynamically changed by a user; and (v) determining whether there is a match between the second hash and one of the plurality of first hashes in the table, wherein if there is a match between the second hash and one of the plurality of the first hashes in the table whitelisting the unknown file; (vi) wherein if there is not a match between the second hash and one of the plurality of the first hashes in the table determining whether the match scores are above a designated threshold numerical value that is between a first numerical value and a second numerical value greater than the first numerical value, and whitelisting the unknown file; (vii) transmitting the match scores information to the unknown system; and (viii) periodically checking the whitelisted unknown file for further threats.