Patent ID: 8266698

Claim:
A computer-implemented method of determining whether an application is a malware threat, the method executed by one or more computer systems and comprising: generating one or more behavior-based features describing an execution of an application on a client; generating one or more client-specific features describing aspects of the client; combining the client-specific features and the behavior-based features to generate a combined feature vector; receiving a malware classifier from a server, the server receiving a plurality of combined feature vectors associated with a plurality of applications from a plurality of clients and generating the malware classifier based at least in part on the plurality of combined feature vectors, the malware classifier statistically modeling hidden dependencies between the client-specific and the behavior-based features to distinguish between innocuous and malicious applications, the hidden dependencies including a characteristic represented by one of the features having an effect on a characteristic represented by another feature; generating a malware score responsive to applying the malware classifier to the combined feature vector; determining whether the application is a malware threat based on the malware score; and storing a result of the determination.