Patent ID: 8037536

Claim:
A method comprising: analyzing a file, by a computing device having a processor, to determine a presence or absence of each of a plurality of predefined properties in the file; calculating a score, by the computing device, based on the presence or absence of the plurality of properties in the file, the score being reflective of a risk that the file is malicious, wherein calculating the score comprises: generating a risk score for each property determined to be present in the file, the risk score reflecting a probability of the respective property existing in a malicious file, generating a weight score for each property, the weight score reflecting a probability of occurrence of the respective property in a non-malicious file, wherein the weight score is inversely related to the probability of occurrence of the respective property in a non-malicious file, and calculating the score based on an aggregate of the risk scores and the weight scores; and further processing the file based on the score, using the computing device.