Patent ID: 8424091

Claim:
A method of detecting computer security threats in a private computer network, the method to be performed by a computer system and comprising: receiving a plurality of target data into the private computer network, the target data coming from outside the private computer network; scanning the plurality of target data for computer security threats by matching the target data against a plurality of patterns of malicious codes generated locally within the private computer network; blocking a particular target data in the plurality of target data, the particular target data matching a first pattern in the plurality of patterns of malicious codes; grouping remaining target data in the plurality of target data that do not match a pattern in the plurality of patterns of malicious codes into a plurality of clusters, each cluster in the plurality of clusters comprising groups of data comprising a computer security threat; generating a second pattern of a particular cluster in the plurality of clusters; and adding the second pattern to the plurality of patterns of malicious codes generated locally within the private computer network.