Patent ID: 8739287

Claim:
A method, comprising: at a server system that includes one or more processors and memory: receiving, from a client, metadata for a plurality of suspicious files detected at the client, wherein the suspicious files are files for which the client was unable to conclusively determine a security status; analyzing the metadata using threat-identification information; identifying a subset of the suspicious files as potentially malicious files based on the results of the analysis; requesting authorization to receive the potentially malicious files from the client; in response to the request, upon authorization for the server system to receive the potentially malicious files from the client, automatically receiving one or more potentially malicious files from the client, wherein transmission of the one or more potentially malicious files from the client to the server system was authorized based on a confidentiality level of the potentially malicious files; and after receiving the one or more potentially malicious files: analyzing the potentially malicious files using threat-identification information available at the server system; and providing, to the client, an indication of the security status of the one or more potentially malicious files based on the analysis of the potentially malicious files.