Patent ID: 8056136

Claim:
A computer implemented method for detecting malware, the method comprising: selecting from a plurality of analytical engines two or more different analytical engines for analyzing a suspicious object for presence of malware, wherein different analytical engines employ different malware analysis techniques; providing to the selected analytical engines information about the suspicious object; receiving from the selected analytical engines results of the analysis of the suspicious object, wherein the results includes a plurality of information parameters associated with the suspicious object, including a parameter identifying the object as malicious or non-malicious; if at least one analytical engine identifies the suspicious object as malicious and at least one other analytical engine identifies the suspicious object as non-malicious, identifying correlations between one or more information parameters of the suspicious object and information parameters of other known malicious and non-malicious objects stored in a knowledge database, wherein two information parameters are correlated when said parameters are substantially similar to each other; and identifying the suspicious object as a malware if the number of identified malicious objects correlated to said suspicious object exceeds the number of identified non-malicious objects correlated to said suspicious object, wherein two objects are correlated when said objects have one or more correlated information parameters.