System and method for using signatures to detect computer intrusions

A method for detecting intrusions on a host comprising the steps of:

• a) providing a signature computer;
• b) computing a computed signature of a file with the signature computer;
• c) comparing the computed signature to a first file signature previously computed by the signature computer;
• d) comparing the computed signature to a second file signature previously computed by other than the signature computer;
• e) determining the file is legitimate if the computed signature matches both the first file signature and the second file signature;
• and
• f) either identifying the file as suspicious or subjecting the file to further analysis if the computed signature does not match the first file signature, the second file signature, or both.

A computer program product for detecting intrusions on a host, the computer program product being embodied in a tangible computer readable medium having machine readable code embodied therein for performing the steps of:

• a) providing a signature computer;
• b) computing a computed signature of a file with the signature computer;
• c) comparing the computed signature to a first file signature previously computed by the signature computer;
• d) comparing the computed signature to a second file signature previously computed by other than the signature computer;
• e) determining the file is legitimate if the computed signature matches both the first file signature and the second file signature;
• and
• f) either identifying the file as suspicious or subjecting the file to further analysis if the computed signature does not match the first file signature, the second file signature, or both.