Patent Document ID: 9959407
Application ID: 15071049

Base Claim:
1. A computer-implemented method for identifying potentially malicious singleton files, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a set of benign singleton files and a set of malicious singleton files; obtaining, for each singleton file in the sets of benign and malicious singleton files, file identification information that identifies the singleton file; using the file identification information of the singleton files from the sets of benign and malicious singleton files to train a classifier to classify unknown singleton files; detecting an unclassified singleton file; analyzing, with the trained classifier, information that identifies the unclassified singleton file; determining, based on the analysis of the information that identifies the unclassified singleton file, that the unclassified singleton file is suspicious; triggering a security action in response to determining that the unclassified singleton file is suspicious.

---

Claim 9:
9. The method of claim 1 , wherein the security action comprises at least one of: triggering an alert that the unclassified singleton file is suspicious; confirming that the unclassified singleton file is malicious; removing the unclassified singleton file from a computing device on which the unclassified singleton file resides.