Patent ID: 8572007

Claim:
A computer-implemented method for classifying unknown files based on user actions, at least a portion of the method being performed by a server-side computing device comprising at least one processor, the method comprising: identifying at least one file whose trustworthiness is unknown due at least in part to the file's prevalence within a user community being below a predetermined prevalence threshold, wherein the predetermined prevalence threshold represents a minimum number of client devices within the user community that have encountered an instance of the file; identifying a report received from at least one client device that identifies at least one action taken by a user within the user community after being informed by security software on the client device that the trustworthiness of the file is unknown; determining that the action taken by the user indicates that the user believes the file is trustworthy even after being informed by the security software on the client device that the trustworthiness of the file is unknown; classifying the file as trustworthy based at least in part on the action taken by the user; providing the file's classification to at least one computing device in order to enable the computing device to evaluate the trustworthiness of the file.