Patent ID: 8671449

Claim:
A computer-implemented method for identifying potential malware, at least a portion of the method being performed by a server-side computing device comprising at least one processor, the method comprising: identifying a file that is subject to a reputation evaluation; identifying a plurality of client submissions received from a plurality of computing systems within a user community, wherein each client submission within the plurality of client submissions identifies: an instance of the file created on a computing system within the user community that is associated with the client submission; at least one additional file created on the computing system at the same time as the instance of the file and within the same file path as the instance of the file; identifying, for each client submission within the plurality of client submissions, a reputation associated with the additional file; generating, for each client submission within the plurality of client submissions, a local reputation score for the file based at least in part on the time and file path of the file and the reputation of the additional file; generating a reputation rating for the file by aggregating the local reputation scores for the plurality of client submissions.