Patent Document ID: 10162967
Application ID: 15239213
Patent Status: 1

Claim One:
1. A computer-implemented method of evaluating a file to determine if the file is on a whitelist, the method comprising: adding known good locality sensitive hashes of legitimate files in a random decision forest data structure; generating a cryptographic hash of a target file; generating a locality sensitive hash of the target file; searching the random decision forest data structure to find a known good locality sensitive hash that is similar to the locality sensitive hash of the target file; deeming the target file to be on the whitelist in response to detecting that the cryptographic hash of the target file does not match any known good cryptographic hash and the locality sensitive hash of the target file is similar to the known good locality sensitive hash found in the random decision forest data structure; and taking a response action against the target file when the target file is not deemed to be on the whitelist.