Methods and apparatus for detection of illicit files in computer networks

A method, comprising:

• generating, at a server device, a hash value of a suspected illicit file stored in a communication device in a computer network;
• comparing, at the server device, the hash value of the suspected illicit file to a list of hash values of known illicit files stored in a database to produce an approximate match value;
• if the hash value of the suspected illicit file has an approximate match value with any hash value from the list of the known illicit files that is above a first threshold but lower than a second threshold, generating an alert signal associated with identifying the suspected illicit file as a possible illicit file;
• and
• if the hash value of the suspected illicit file has the approximate match value with any hash value from the list of the known illicit files that is above the second threshold, generating an alert signal associated with the match and identifying the suspected illicit file as an illicit file.

An apparatus, comprising:

• a processor operatively coupled to a memory and configured to execute a hashing module and a matching module;
• the hashing module configured to receive a hash value of a known illicit file;
• the matching module configured to compare the hash value of the known illicit file to a first list of hash values of known illicit files stored in a database;
• if the hash value of the known illicit file does not match any hash value from the first list of hash values, the matching module configured to add the hash value of the known illicit file to the first list of hash values of known illicit files to define a second list of hash values of known illicit files;
• the hashing module configured to generate a hash value a suspected illicit file;
• the matching module configured to compare the hash value of the suspected illicit file to the second list of hash values of known illicit files stored in a database to produce an approximate match value;
• if the hash value of the suspected illicit file has the approximate match value with any hash value from the second list of the known illicit files that is above a threshold, the matching module configured to generate an alert signal identifying the suspected illicit file as an illicit file.