Patent Document ID: 9690933
Application ID: 14579896
Patent Flag: 1

Claim One:
1. An apparatus comprising: one or more processors; and a non-transitory storage medium communicatively coupled to the one or more processors, the non-transitory medium includes a first analysis engine that comprises a detection engine that analyzes an object to determine if the object is malicious, and a classification engine that is configured to (i) receive results of the analysis of the object conducted by the detection engine, and (ii) analyze, based at least in part on the results from the detection engine, whether the object is determined to be malicious in accordance with a predictive model, wherein, in response to the detection engine and the classification engine differing in a determination as to whether the object is to be classified as malicious, transmitting information associated with at least a portion of the results from the analysis of the object by at least one of the detection engine and the classification engine to a service remotely located from the apparatus and receiving an update of the predictive model for use by the classification engine, the update of the predictive model is conducted to reduce a number or a rate of at least false negative determinations by the classification engine using the predictive model, and wherein, in response to the detection engine and the classification engine being consistent in the determination as to whether the object is to be classified as malicious or non-malicious, refraining by the first analysis engine from transmitting the information associated with at least the portion of the results to the service.