Abstract: Methods and systems for detecting threats using threat signatures loaded in a computing device.

Abstract: Methods and systems for generating a plurality of threat signatures. In one embodiment, the method includes receiving at an interface a first plurality of threat signatures; adding, using one or more processors executing instructions stored on memory, at least one metadata attribute to each of the first plurality of threat signatures, wherein the at least one added metadata attribute is a cost associated with the threat signature that is obtained by determining a difference in performance between an execution of an inspection engine against a test case without the threat signature and an execution of the inspection engine against the test case with the threat signature; adding, using the one or more processors, a signature score to each of the first plurality of threat signatures calculated utilizing the at least one added metadata attribute; and transmitting the plurality of threat signatures including signature scores to a computing device configured for scanning network activity.

Abstract: Methods and systems for detecting threats using threat signatures loaded in a computing device.