Patent ID: 8418250

Claim:
A method of classifying a computer object as malware, the method comprising: at a base computer, receiving data about a computer object from each of plural remote computers on which the object or similar objects are stored, the data including information about the behaviour of the object running on one or more remote computers; determining in the base computer whether the data about the computer object received from the plural computers indicates that the computer object is malware; classifying the computer object as malware when the data indicates that the computer object is malware; when the determining does not indicate that the computer object is malware, initially classifying the computer object as not malware; automatically generating a mask for the computer object that defines acceptable behaviour for the computer object, wherein the mask is generated in accordance with normal behaviour of the object determined from said received data; running said object on at least one of the remote computers; automatically monitoring operation of the object on the at least one of the remote computers; allowing the computer object to continue to run when behaviour of the computer object is permitted by the mask; disallowing the computer object to run when the actual monitored behaviour of the computer object extends beyond that permitted by the mask; and, reclassifying the computer object as malware when the actual monitored behaviour extends beyond that permitted by the mask.