Patent ID: 8640245

Claim:
A computer-implemented method for optimization of anti-virus (AV) processing, the method comprising: (a) creating a database of malware detection rules and a database of correction coefficients on an AV server, wherein the detection rules include test rules having zero correction coefficients; (b) updating a user-side database of malware detection rules and a user-side database of correction coefficients with current data from the database of malware detection rules and the database of correction coefficients on the AV server; (c) receiving, from users running user processes, at the AV server, data related to the user processes, if the process aggregate rating exceeds a safety threshold but is below a danger threshold; (d) accumulating received data related to the user process on an AV server data storage; (e) analyzing false-negative determinations; and (f) updating the database of correction coefficients on the AV server based on the aggregate false-negative determinations, including updating at least some coefficients of the test rules to be non-zero coefficients to convert corresponding test rules into detection rules.