Patent ID: 8214977

Claim:
A computer-implemented method for detecting malware, comprising: locally storing on a client device, a filter based on a set of known malware definitions, and locally storing on the client device a subset of known malware definitions from the set of known malware definitions, the subset selected based on a determined likelihood of malware corresponding to the known malware definitions being detected on the client device; applying the filter to an input file to detect if the input file has characteristics matching those of a malware definition in the set of known malware definitions; responsive to the input file having characteristics matching those of the malware definition based on applying the filter, determining if the malware definition is stored locally in the subset of known malware definitions; responsive to the input file having characteristics matching those of the malware definition and the malware definition not being stored locally, obtaining the malware definition from a central server; scanning the input file using the obtained malware definition; determining if the input file comprises malware based on the scanning; and responsive to the input file not comprising the malware based on the scanning, sending a report to the central server identifying the input file; and receiving from the central server in response to the report, a modified filter to reduce a likelihood of a false positive occurring in a future application of the filter if the input file is determined not to comprise the malware based on the scanning.