Abstract: A malware detection/identification system scores each subject file and/or scores ‘tags’ obtained from the subject file to determine the potential that the file contains malicious components. A file or tag score tending to indicate that the subject file may contain malicious components/properties/attributes, may be used to notify the system (and a user of the system) that the file may be potentially malicious, so that the file may be quarantined and subject to further analysis. Embodiments of the current disclosure utilize a database structure that contains multitudes (e.g., hundreds, thousands, or even millions) of “tags” that have been pulled from known malicious and known benign sample files, where the database provides many-to-many relations between the known sample files and the tags.

Abstract: A malware detection/identification system scores each subject file and/or scores ‘tags’ obtained from the subject file to determine the potential that the file contains malicious components. A file or tag score tending to indicate that the subject file may contain malicious components/properties/attributes, may be used to notify the system (and a user of the system) that the file may be potentially malicious, so that the file may be quarantined and subject to further analysis. Embodiments of the current disclosure utilize a database structure that contains multitudes (e.g., hundreds, thousands, or even millions) of “tags” that have been pulled from known malicious and known benign sample files, where the database provides many-to-many relations between the known sample files and the tags.