Patent ID: 7748039

Claim:
One or more computer-readable media storing program instructions executable by an information handling system to: while a first program is running on the information handling system in a manner that permits the first program to infect the information handling system, perform a plurality of detection routines to gather information relating to the first program, wherein the plurality of detection routines include a first set of malicious code detection routines and a second set of valid code detection routines; calculate a first composite score and a second composite score based on results of the plurality of detection routines, wherein said first composite score is indicative of the likelihood that the first program is malicious and is calculated using weights associated with those detection routines within the first set of malicious code detection routines whose results are indicative of the first program being malicious code, and wherein said second composite score is indicative of the likelihood that the first program is valid and is calculated using weights associated with those detection routines within the second set of valid code detection routines whose results are indicative of the first program being valid code, and wherein the second composite score is calculated independently from the first composite score; and use the first and/or second composite scores to categorize the first program with respect to the likelihood of the first program infecting the information handling system, including: categorizing the first program as malicious code when the first composite score is above a malicious code threshold value and the second composite score is below a valid code threshold value; and categorizing the first program as valid code when the second composite score is above the valid code threshold value.