Collaborative malware scanning

Abstract

In some embodiments, a malware detecting system is configured to conduct an iterative, collaborative scan of a target object (computer file or process), comprising a server-side scan and a client-side scan, and to assess the malware status of the target object according to the results of the client-side and server-side scans. The client-side scan comprises computationally-intensive operations such as virtual-environment emulation, decryption and data compression methods, while the server-side scan comprises database-intensive operations such as hash lookups. The information exchanged between client and server systems may be limited to relatively-compact data, such as hashes, which may amount to a few bytes per target object. Exemplary methods and systems described herein allow storing malware signature databases on the server side, thus reducing the burden of frequently delivering data-heavy signature updates to large numbers of customers, without requiring the server side to perform computationally-intensive scanning tasks for large numbers of customers.