Patent ID: 8739283

Claim:
A method of deleting malware files from a computing device, the method comprising: detecting malware execution on the computing device, the malware execution detected by a malware detection engine, the engine creating a local detection data set corresponding to the detected malware, the local detection data set indicating how the detected malware operates on the computing device; querying a remote source using the local detection data set; receiving a malware behavior data set in response to the query, the malware behavior data set indicating how the detected malware operated on at least one other computing device; running a graph similarity algorithm, wherein a first input to the algorithm is a first graph representing the malware behavior data set and a second input to the algorithm is a second graph representing the local detection data set, wherein the first graph includes at least first and second nodes and a link, wherein said first node is a process said second node is a file, and said link is a step taken by said detected malware that describes a relationship between said process and said file; outputting a third graph representing a degree of similarity between the first graph and the second graph; creating a modified malware behavior data set based upon the third graph; generating a malware deletion software module using the modified malware behavior data set; and executing the malware deletion software module and deleting one or more malware files associated with the detected malware from the computing device.