Patent ID: 8813222

Claim:
A malware detection system comprising at least one processor configured to form: a client scan engine configured to perform on a client computer system a client-side part of a collaborative scan of a target object to produce a client-side scan result, wherein the client-side part of the collaborative scan comprises emulating a code sequence of the target object in a virtual environment; and a client communication manager connected to the client scan engine and configured to: iteratively send a sequence of client-initiated hash lookup requests for the target object from the client computer system to a malware detection server system, each client-initiated hash lookup request including a hash of a section of the target object, and iteratively receive at the client computer system a sequence of server-side hash lookup results of a server-side part of the collaborative scan of the target object, wherein the server-side part of the collaborative scan comprises a sequence of hash lookups performed by the malware detection server system according to hashes of sections of the target object, wherein a client-initiated hash lookup request after a first hash lookup request in the sequence of client-initiated hash lookup requests is individually initiated by the client computer system in response to determining that a received server-side hash lookup result is inconclusive as to a malware status of the target object; and a risk assessor connected to the client communication manager, the risk assessor being configured to determine whether the target object is malicious according to the client-side part of the collaborative scan and the server-side part of the collaborative scan, the risk assessor being further configured to check whether a condition for a termination of the collaborative scan is satisfied.