Abstract: A method and apparatus for determining the identity of suspected malware on a client device. Information pertaining to the malware is sent from the client device to a server. The server determines a first required information set, and sends a request to the client device for the required information set. The client device compares the required information set with information stored at the client device, and returns the results of the comparison to the server. The server uses the results of the comparison to attempt to determine an identity of the malware. If the results of the comparison indicate that the suspected malware is one of a plurality of types of malware, a new required information set is determined, which is sent back to the client device, and the process repeated. Otherwise the identity of the suspected malware is determined, or it is determined that the suspected malware is unknown to the server.