Patent ID: 8321941

Claim:
A method comprising: developing a probability model for a plurality of malware, wherein developing comprises: extracting a feature set from a plurality of predetermined malware-infected applications, the feature set comprising one or more feature elements corresponding to instructions within the predetermined malware-infected applications that import DLLs, and wherein each of the plurality of predetermined malware-infected applications can be executed by mobile devices; heuristically training one or more rules using a plurality of predetermined malware-free applications and the predetermined malware-infected applications, wherein the rules describe a malicious probability relationship of the feature elements in the feature set and unknown applications that can be executed by the mobile devices; creating the probability model from the rules and the feature set; creating a first set of search values comprising a first set of hash values hashed from prefixes of a set of malware signatures derived from the plurality of predetermined malware-infected applications, each of the prefixes having a first-portion-size, wherein at least one of the malware signatures has a length greater than the first-portion-size; creating a second set of search values comprising a second set of hash values hashed from the set of malware signatures; and distributing the probability model, the first set of search values, and the second set of search values to a mobile device to cause the mobile device to determine a probability that an application is malware-infected using at least one of the probability model, the first set of search values, and the second set of search values when the mobile device detects a match with one of the first set of search values.