Patent ID: 8214904

Claim:
A computer-implemented method for detecting unknown security threats, the method comprising: receiving from an antivirus application deployed on a user's computer information about an unknown security event associated with a software object executing on said computer, and a user's verdict indicating that the software object is harmful or harmless to the security of said computer; identifying the user of said computer and a role of said user, wherein the user's role indicates user's level of expertise in the field of computer security; if the role of said user indicates that the user has a high level of expertise in the field of computer security, accepting the user's verdict that the software object is harmful or harmless; if the role of said user indicates that the user has a low level of expertise in the field of computer security, analyzing the information about the security event received from the antivirus application to verify that the user's verdict is correct; and if the user's verdict was accepted or verified to be correct, updating an antivirus database, which is associated with the antivirus application and contains information about known harmful and harmless software objects, with said information about the security event and indication that associated software object is harmful or harmless.