Centralized Scanner Database With Qptimal Definition Distribution Using Network Queries

A computer program product for detecting malware, the computer program product comprising a computer-readable storage medium containing computer program code for:

• applying a filter to an input file to detect if the input file has characteristics matching those of a malware definition in a set of known malware definitions;
• responsive to the input file having characteristics matching those of the malware definition based on applying the filter, scanning the input file using the malware definition;
• and
• determining if the input file comprises malware based on the scanning.

A method for distributing malware definitions to a client device, comprising:

• generating a filter from a set of known malware definitions, wherein the filter detects if an input file has characteristics matching those of the set of known malware definitions;
• distributing the filter to the client device;
• and
• distributing a subset of malware definitions from the set of known malware definitions used to generate the filter to the client device together with the filter.