Abstract: In one aspect, a method obtains a set of expert-media content files and an index of the set of expert-media content files. A set of user attributes are obtained. A request from user-side application to download an expert-media content file is received. The set of expert-media content files, the index of the set of expert-media content computer data store, the request to download the expert-media content file and the set of user attributes are stored in a computerized data store. With the processor of a server it implementing delivering predictive expert-media content to the user's mobile device, the set of expert-media content files, the index of the set of expert-media content files in a computer data store, the request to download the expert-media content file and the set of user attributes are extracted from the computerized data store. With a recommendation engine operating in the server, the index of the set of expert media-content files is ranked based on the set of user attributes.

Abstract: A method and apparatus for evaluating hygiene of a computer are described. In some examples, attributes of an operating system on the computer are analyzed to assign values to operating system state variables. Attributes of application software installed on the computer are analyzed to assign values to application software state variables. Weights are assigned to the operating system state variables and the application software state variables based on the respective values thereof. A hygiene rating for the computer is determined based on the weights, the hygiene rating indicative of the propensity of the computer to attract malware.

Abstract: A computer-implemented method for using client reputation data to classify web domains may include identifying a web domain. The computer-implemented method may also include identifying at least one client that has attempted to access the web domain. The computer-implemented method may further include identifying a reputation associated with the client that attempted to access the web domain. The computer-implemented method may additionally include classifying the web domain based at least in part on the reputation of the client that attempted to access the web domain. Various other methods, systems, and computer-readable media are also disclosed.

Abstract: One or more behavior-based features describing an execution of an application on a client are generated. One or more client-specific features are generated, wherein the client-specific features describe aspects of the client. A malware score is generated based on the behavior-based features and the client-specific features. Whether the application is a malware threat is determined based on the malware score and a result of the determination is stored.

Abstract: A computer-implemented method for detecting automated spam programs designed to transmit unauthorized electronic mail via endpoint machines may comprise: 1) monitoring electronic-mail traffic on an endpoint machine, 2) identifying a computer program on the endpoint machine that is responsible for at least a portion of the electronic-mail traffic on the endpoint machine, 3) accessing at least one rule for determining, based on characteristics of the program, whether the program comprises a spam program, and then 4) determining, by applying the rule to the program, whether the program comprises a spam program. Corresponding systems and computer-readable media are also disclosed.