Patent ID: 8706745

Claim:
A computer-implemented method for determining a file set, at least a portion of the computer-implemented method being performed by a computing device comprising at least one processor, the computer-implemented method comprising: determining whether files in a file set are known-good files at least in part by: identifying the file set at least in part by identifying a set of files to be scanned during a security scan of a first computing system; identifying a key file for the file set, the first computing system comprising the file set, the presence of the key file on the first computing system implying the presence of the file set on the first computing system; transmitting a key-file identifier to a second computing system, the key-file identifier identifying the key file, instead of transmitting identifiers of each file in the file set, such that a resource load involved in determining whether the files in the file set are known-good files is reduced; receiving first and second file identifiers from the second computing system, the first file identifier being associated with a first file-identifier set, the second file identifier being associated with a second file-identifier set, and the key-file identifier being associated with both the first file-identifier set and the second file-identifier set; determining at least one of: whether the file set comprises a file identified by the first file identifier; whether the file set comprises a file identified by the second file identifier; transmitting a result of the determination to the second computing system.