A method for generating a set of antivirus records, the method comprising: maintaining, by a server, a database of files, wherein the database of files is configured to store malicious files, trusted files and untrusted files; generating, by the server, several antivirus records containing different locality sensitive hashes for each malicious file in the database of files, wherein each of the several antivirus records includes a locality sensitive hash calculated from a different set of file attributes of the malicious file; calculating, by the server, an effectiveness of each antivirus record by determining how many different malicious files were detected using each antivirus record and a number of false positive detections by said antivirus record; generating, by the server, a set of most effective antivirus records, comprising: selecting for each known malicious file the most effective antivirus record used in detection of said malicious file, wherein the most effective antivirus record is calculated as a function of both the number of different malicious files detected by the antivirus record and the number of false positive detections by the antivirus record; determining whether the selected antivirus record is already in the set; and responsive to determining that the selected antivirus record is not in the set, adding said record to the set; and transmitting, by the server, the set of most effective antivirus records to a client device. maintaining, by a server, a database of files, wherein the database of files is configured to store malicious files, trusted files and untrusted files; generating, by the server, several antivirus records containing different locality sensitive hashes for each malicious file in the database of files, wherein each of the several antivirus records includes a locality sensitive hash calculated from a different set of file attributes of the malicious file; calculating, by the server, an effectiveness of each antivirus record by determining how many different malicious files were detected using each antivirus record and a number of false positive detections by said antivirus record; generating, by the server, a set of most effective antivirus records, comprising: selecting for each known malicious file the most effective antivirus record used in detection of said malicious file, wherein the most effective antivirus record is calculated as a function of both the number of different malicious files detected by the antivirus record and the number of false positive detections by the antivirus record; determining whether the selected antivirus record is already in the set; and responsive to determining that the selected antivirus record is not in the set, adding said record to the set; and selecting for each known malicious file the most effective antivirus record used in detection of said malicious file, wherein the most effective antivirus record is calculated as a function of both the number of different malicious files detected by the antivirus record and the number of false positive detections by the antivirus record; determining whether the selected antivirus record is already in the set; and responsive to determining that the selected antivirus record is not in the set, adding said record to the set; and transmitting, by the server, the set of most effective antivirus records to a client device.