Patent ID: 8474044

Claim:
A system, comprising: a processor; a memory; and an intrusion prevention application, which, when executed by the processor is configured to verify anti-malware signatures by performing an operation, comprising: detecting a first attack on a server application executing on the system, determining a candidate payload being processed by the server application contemporaneous to the detected attack, generating a provisional signature corresponding to the first attack, upon determining a first payload addressed to the server application matches the provisional signature, monitoring the effects of the first payload when processed by the server application, upon determining that processing the first payload results in a second attack on the server application, increasing a confidence metric associated with the provisional signature, upon determining the confidence metric associated with the provisional signature matching the first payload exceeds a predetermined threshold, storing the provisional signature as a verified anti-malware signature, upon determining at least a second payload intended for the server application matches the provisional signature, monitoring the effects of the second payload when processed by the server application, and upon determining that processing the second payload does not result in an attack on the server application, discarding the provisional signature.