Patent ID: 8584235

Claim:
A method comprising: performing at a client computer system an initial malware scan of a plurality of target objects of the client computer system; and in response to a tentative determination by the initial malware scan that the target object is suspected of being malicious: generating at the client computer system a plurality of target hashes of the target object, each target hash representing a distinct code block of the target object, each distinct code block consisting of a sequence of processor instructions of the target object; sending from the client computer system the plurality of target hashes to a server computer system connected to the client computer system over a wide area network; and receiving at the client computer system from the server computer system a server-side indicator of whether the target object is malicious, wherein the server-side indicator is generated by the server computer system by: for at least a target hash of the plurality of target hashes, retrieving a plurality of reference hashes of a reference object, the reference object selected from a set of whitelisted objects according to the target hash, and when the plurality of target hashes is not identical to the plurality of reference hashes, determining a similarity score according to a count of hashes common to both the plurality of target hashes and the plurality of reference hashes; and when the similarity score exceeds a predetermined threshold, designating the target object as non-malicious.