Patent Document ID: 9483643
Application ID: 14656739

Base Claim:
1. A computer-implemented method for creating behavioral signatures used to detect malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: maintaining a database that identifies: known malicious files and behaviors exhibited by the known malicious files; known non-malicious files and behaviors exhibited by the known non-malicious files; creating a behavioral signature used to detect malware by: determining a combination of behaviors exhibited by at least one of the known malicious files identified within the database; identifying the number of known malicious files that exhibit each behavior within the combination of behaviors; identifying the number of known non-malicious files that exhibit each behavior within the combination of behaviors; determining that the number of known malicious files that exhibit each behavior within the combination exceeds the number of known non-malicious files that exhibit each behavior within the combination by a certain threshold; incorporating representations of each behavior within the combination of behaviors into the behavioral signature.

---

Claim 2:
2. The method of claim 1 , wherein maintaining the database comprises receiving the known malicious files and the known non-malicious files from at least one endpoint computing device.