Generating analytical data from detection events of malicious objects

A non-transitory computer-readable storage medium storing instructions for detecting malicious objects, the instructions when executed by a processor causing the processor to perform steps including:

• receiving, from a malware detection application executing on a client, client information indicating a client state describing at least one protection application executing on the client and a geolocation associated with the client;
• receiving, from the malware detection application, a new detection event describing a malicious object on the client that went undetected by the at least one protection application and was subsequently detected by the malware detection application when the client is in the client state, the new detection event further including a time associated with the new detection event;
• mapping the new detection event to the client state when the malicious object was detected for storage in a detections database;
• generating aggregate detection information by aggregating the new detection event with historical detection events stored in the detections database for a plurality of clients executing instances of the malware detection application and instances of the at least one protection application, the aggregate detection information indicating a count of detection events on the plurality of clients in which the malicious object went undetected by the respective instances of the at least one protection application and was subsequently detected by the instances of the malware detection application;
• generating a user interface displaying the count of detection events and including a control for generating a playback of the aggregate detection information, wherein in response to selection of the control, the user interface displays a sequence of indicators at coordinates of a map corresponding to respective geolocations of the historical detection events, the indicators being displayed according to the respective times associated with the historical detection events to indicate geographic spread of the malicious object on the plurality of clients;
• and
• providing the user interface to an administrative client for presentation.

A computing system comprising:

• a processor;
• and
• a non-transitory computer-readable storage medium storing instructions for detecting malicious objects, the instructions when executed by the processor causing the processor to perform steps including:
• receiving, from a malware detection application executing on a client, client information indicating a client state describing at least one protection application executing on the client and a geolocation associated with the client;
• receiving, from the malware detection application, a new detection event describing a malicious object on the client that went undetected by the at least one protection application and was subsequently detected by the malware detection application when the client is in the client state, the new detection event further including a time associated with the new detection event;
• mapping the new detection event to the client state when the malicious object was detected for storage in a detections database;
• generating aggregate detection information by aggregating the new detection event with historical detection events stored in the detections database for a plurality of clients executing instances of the malware detection application and instances of the at least one protection application, the aggregate detection information indicating a count of detection events on the plurality of clients in which the malicious object went undetected by the respective instances of the at least one protection application and was subsequently detected by the instances of the malware detection application;
• generating a user interface displaying the count of detection events and including a control for generating a playback of the aggregate detection information, wherein in response to selection of the control, the user interface displays a sequence of indicators at coordinates of a map corresponding to respective geolocations of the historical detection events, the indicators being displayed according to the respective times associated with the historical detection events to indicate geographic spread of the malicious object on the plurality of clients;
• and
• providing the user interface to an administrative client for presentation.