Malware Detection Method

A method of detecting malware on a client computer, the method comprising:

• at the client computer:
• generating a hash of an entity, whereby the entity is suspected to be malware;
• sending the hash to a network server;
• receiving a response from the network server on the reputation of the hash, and, if the reputation is not known at the server, receiving instructions for obtaining further information about the entity,
• wherein said further information is obtained by executing code at the client computer received from the server after said sending the hash to a network server.

A method of detecting malware on a client computer, the method comprising:

• at the server:
• receiving a hash of an entity, whereby the entity is suspected to be malware;
• considering the reputation of the hash by comparing the hash to a database of hashes of known reputation;
• returning the results of said considering to the client computer, and, if the reputation is not known at the server, sending instructions to the client computer for obtaining further information about the entity at the client computer,
• providing code to the client computer for obtaining further information.

A client computer comprising:

• a transceiver for sending a hash of an entity to a server and receiving a request for further information from the server;
• a module for executing code received from the server for obtaining further information from the entity;
• a database for storing said code;
• wherein the transceiver is further suitable for sending said further information to the server.

A server comprising:

• a transceiver for receiving a hash of an entity from a client computer;
• a database of hashes of known entities;
• a module for determining the reputation of the hash by comparing the hash to the database of hashes and for determining if the file is malicious using the results of the comparison;
• a database of code for providing the client computer with code for obtaining further information about the entity;
• a malware analysis module for analysing the further information in order to determine if the entity is malware.

A method of detecting malware on a client computer, the method comprising:

• detecting an event relating to an entity at the client computer, whereby the entity is suspected to be malware;
• generating a metadata package of said entity at the client computer;
• transmitting the metadata package to a node over a network;
• analysing the metadata at the node;
• sending instructions from the node to the client computer to collect further data related to the entity.