Patent Document ID: 9485272
Application ID: 14307477

Base Claim:
1. A computer-implemented method for estimating confidence scores of unverified signatures, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting a potentially malicious event that triggers a malware signature designed to detect malware, the malware signature having a confidence score that: represents a level of confidence in the accuracy or reliability of the malware signature; and is above a certain threshold such that the malware signature's confidence score indicates a threshold level of confidence in the accuracy or reliability of the malware signature; detecting another event that triggers another signature designed to detect malware, the other signature having a confidence score that: represents a level of confidence in the accuracy or reliability of the other signature; and is unknown such that the other signature's confidence score indicates an unknown level of confidence in the accuracy or reliability of the other signature; determining that the potentially malicious event and the other event occurred within a certain time period of one another; and assigning, to the other signature, a confidence score based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another.

---

Claim 8:
8. The method of claim 1 , wherein: detecting the potentially malicious event that triggers the malware signature comprises detecting, on a single computing device, one or more potentially malicious events that trigger one or more malware signatures whose confidence scores are above a certain threshold and below another threshold; determining that the potentially malicious event and the other event occurred within the certain time period of one another comprises determining that the one or more potentially malicious events and the other event occurred within the certain time period of one another on the single computing device; and assigning the confidence score to the other signature comprises: calculating a confidence score for the other signature based at least in part on: the number of the one or more potentially malicious events detected on the single computing device; and the confidence scores of the one or more potentially malicious events detected on the single computing device; and assigning the calculated confidence score to the other signature.