Patent ID: 8769691

Claim:
A method of forming a cache for use in malware detection, said method comprising: retrieving a plurality of hash value-result pairs from an access log database, each hash value uniquely identifying a computer file suspected of being malware and wherein the result of each of said pairs depends upon its corresponding hash value and wherein the result of each of said pairs indicates whether or not its corresponding hash value does identify malware; for each of said hash value-result pairs, retrieving at least one other attribute and its value from a data record associated with said each hash value-result pair; grouping a subset of said hash value-result pairs into a single group wherein the value of said at least one other attribute is the same for all of said hash value-result pairs in said single group; identifying a plurality of user computers each having a characteristic that matches with said same value of all of said hash value-result pairs in said single group; and downloading said single group of hash value-result pairs to each of said user computers to be used as said cache.