Patent Document ID: 9245120
Application ID: 13942360
Patent Status: 1

Claim One:
1. A system for intelligently rescanning files previously identified as having a benign, unknown, or malicious disposition, comprising: a plurality of clients and a server which are capable of communicating with each other either directly or indirectly; wherein each client is configured to: identify files of interest from a plurality of files on a file system based upon activity of the files including creating, moving, copying or executing the files; extract meta-data from the files of interest, including the files of interest that have previously been assigned a benign, an unknown or a malicious disposition, and provide the server with the files of interest and an identifier for each of the files of interest indicating respective clients on which the files of interest are located as well as the associated meta-data for each of the files of interest, and wherein the server is configured to: log the files of interest and the associated meta-data into log files, and periodically scan the log files to identify a subset of files whose characteristics indicate a probable disposition change; rescan the identified files against information stored at the server at a time of rescanning to determine whether a disposition change has occurred for each of the identified files; and identify the respective clients corresponding to the rescanned files having a disposition change.