Patent Document ID: 9485272
Application ID: 14307477

Base Claim:
1. A computer-implemented method for estimating confidence scores of unverified signatures, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting a potentially malicious event that triggers a malware signature designed to detect malware, the malware signature having a confidence score that: represents a level of confidence in the accuracy or reliability of the malware signature; and is above a certain threshold such that the malware signature's confidence score indicates a threshold level of confidence in the accuracy or reliability of the malware signature; detecting another event that triggers another signature designed to detect malware, the other signature having a confidence score that: represents a level of confidence in the accuracy or reliability of the other signature; and is unknown such that the other signature's confidence score indicates an unknown level of confidence in the accuracy or reliability of the other signature; determining that the potentially malicious event and the other event occurred within a certain time period of one another; and assigning, to the other signature, a confidence score based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another.

---

Claim 7:
7. The method of claim 1 , wherein: detecting the potentially malicious event that triggers the malware signature comprises detecting the potentially malicious event on each of a plurality of computing devices; detecting the other event that triggers the other signature comprises detecting the other event on each of the plurality of computing devices; determining that the potentially malicious event and the other event occurred within the certain time period of one another comprises determining that the potentially malicious event and the other event occurred within the certain time period of one another on each of the plurality of computing devices; and assigning the confidence score to the other signature comprises assigning the confidence score to the other signature based at least in part on the potentially malicious event and the other event occurring within the certain time period of one another on each of the plurality of computing devices.