Silent-mode signature testing in anti-malware processing

A silent-mode method for generating a detecting signature, the method being performed on a client computer having a processor and a memory, the method comprising:

• (a) generating a test silent-signature and applying it on the client computer without informing a user of a match with signatures of objects from a white list or a black list;
• (b) analyzing test silent-signature statistics for false positive occurrences;
• (c) turning off the test silent-signature on the client computer , if a number of false positive occurrences exceeds a threshold, otherwise, converting the test silent-signature into a detecting signature and subsequently utilizing the detecting signature for malicious object identification;
• and
• (d) sending the test silent-signature from the client computer to a server for further analysis, if the false positive occurences are confirmed, and
• wherein the test silent-signature is converted into the detecting signature after a pre-set time interval.

A system for anti-malware processing by using a detecting signature, the system comprising:

• a server, comprising a processor and a memory, wherein the server generates a test silent-signature for application on client computers without informing a user of matches with signatures of objects from a white list or a black list;
• one or more databases accessible by the server containing signatures of clean objects and malicious objects;
• a statistics module coupled to the server for collecting statistics from the client computers for the test silent-signature, wherein:
• the server receives the test silent-signature from the client computer for further analysis, if false positives are confirmed,
• analyzes the test silent-signature statistics for false positive occurrences, and
• turns off the test silent-signature for users, if a number of false positive occurrences exceeds a threshold, otherwise, converts the test silent-signature into a detecting signature and provides the detecting signature to the client computers for subsequently utilizing the detecting signature for malicious object identification.