Patent ID: 8726377

Claim:
A method of making a determination of whether an electronic file stored at a client device is malware, the method comprising: receiving at a server from the client device a request message comprising signature information of the electronic file; querying a database storing signature information of a multiplicity of electronic files; if the signature information of the electronic file corresponds to signature information stored on the database, determining whether the electronic file is malware, in the event that the signature information of the electronic file does not correspond to signature information stored on the database, determining whether a predetermined number of further request messages relating to the electronic file are received from further client devices within a predetermined time period, and in the event that fewer than the predetermined number of further request messages are received within the predetermined time period, determining that the electronic file is likely to be malware, and in the event that more than the predetermined number of further request messages are received within the predetermined time period, determining that the electronic file is not likely to be malware; and sending the result of the determination to the client device.