Patent ID: 7774451

Claim:
A method of classifying a file of interest in a computer network, comprising: receiving, over the computer network, file statistics for a plurality of users and a plurality of files; processing the file statistics to identify: (i) a set of users in the plurality of users that received the file of interest; (ii) a group of shared files in the plurality files, where each file in the group of shared files was received by at least two users in the set of users; and (iii) numbers of infected files received by respective users in the set of users; computing an average ratio of a number of infected files to a total number of files in the group of shared files using a Monte Carlo process constrained by: (i) indications of which users in the set of users received which files in the group of shared files; and (ii) the numbers of infected files received by the respective users; and assigning a probability of infection to the file of interest based on the average ratio.