# US 2020/0401694 A1 · Methods and Apparatus for Malware Threat Research

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401694 A1
- Document ID: US20200401694A1
- Status: Published application
- Kind: A1
- Application number: 17/011,398
- Filed: 2020-09-03
- Published: 2020-12-24
- Earliest claimed: 2005-06-30
- Assignees: Webroot Inc.
- Applicants: Webroot Inc.
- Inventors: Melvyn Morris; Paul Stubbs; Markus Hartwig; Darren Harter
- Web page: https://patentgrep.com/patent/US20200401694A1

## CPC

- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In one aspect, a method of classifying a computer object as malware includes receiving at a base computer data about a computer object from each of plural remote computers on which the object or similar objects are stored. The data about the computer object received from the plural computers is compared in the base computer. The computer object is classified as malware on the basis of said comparison. In one embodiment, the data about the computer object includes one or more of: executable instructions contained within or constituted by the object; the size of the object; the name of the object; the logical storage location or path of the object on the respective remote computers; the vendor of the object; the software product and version associated with the object; and, events initiated by or involving the object when the object is created, configured or runs on the respective remote computers.

## Claims

### Claim 1

A method of classifying a computer object as malware or as safe, wherein the computer object is a descendant or otherwise related object of a first computer object, the method comprising: classifying a first computer object as malware; identifying in a key relating to the first computer object a component that uniquely Identifies the first computer object and that is inherited or otherwise present in the key of a related computer object of the first computer object; and classifying the related computer object as malware based on the unique identifier component being present in the key of the computer object.