Patent Document ID: 9646159
Application ID: 14675460
Patent Status: 1

Claim One:
1. A device, comprising: one or more processors to: identify a plurality of files for a multi-file malware analysis; execute the plurality of files in a malware testing environment; monitor the malware testing environment for a behavior indicative of malware; detect the behavior indicative of malware; modify a plurality of malware scores, corresponding to the plurality of files, based on detecting the behavior indicative of malware; determine that two or more malware scores, of the plurality of malware scores, satisfy a threshold; partition the plurality of files into two or more segments of files based on determining that the two or more malware scores satisfy the threshold, the two or more segments of files corresponding to the two or more malware scores; analyze the two or more segments of files for malware; determine that a segment of files, included in the two or more segments of files, includes malware based on analyzing the two or more segments of files; and analyze at least one file, included in the segment of files, for malware based on determining that the segment of files includes malware.