Patent ID: 8904520

Claim:
A computer-implemented method of determining a reputation associated with an entity, the method comprising: receiving, by at least one server from a client, information indicating a communication between the entity and a host that the entity communicates with, wherein the communication is monitored by the client and occurs while the entity is executed on the client, the entity comprising a file or software application; identifying, by the least one server, reputation information indicating reputations of a set of other entities that communicate with the host; generating, by the least one server, a host reputation score indicating a reputation of the host that the entity communicates with based on the reputation information indicating reputations of the set of other entities that communicate with the host; generating, by the least one server, an entity reputation score indicating a likelihood that the entity is malware based on the host reputation score indicating the reputation of the host that the entity communicates with; and transmitting, by the at least one server, the entity reputation score to the client for malware remediation.