The Internet has enabled interconnection of different computer networks all over the world. The ability to effectively protect and maintain stable computers and systems, however, presents a significant obstacle for component manufacturers, system designers, and network operators. This obstacle is made even more complicated due to the continually-evolving array of tactics exploited by malicious software authors. Malicious software authors create malicious software (“malware”) to disrupt or stop computer operations, steal information, gain unauthorized access to system resources, and conduct other unauthorized abusive, hostile, intrusive, or annoying activities. Malware continues to evolve with new malware objects being developed potentially exposing computers and systems every day.
Malware detection and prevention software, among other computer security products, have been developed to detect, block, disable, quarantine, and delete malware from systems using the computer security products. One of the challenges facing computer security products is distinguishing malware from ostensibly non-malicious software objects. Complicating this endeavor is the reality that hundreds of thousands of new software objects, both malicious and non-malicious are created every day. Some security products use whitelists to distinguish non-malicious, whitelisted objects from malicious objects. Whitelists can also serve as a record of the classification of a detected object as either malicious or non-malicious. Ideally, whitelists, in order to be optimally effective, should be as comprehensive as possible. Maintaining and creating a comprehensive whitelist can be a challenge given the steady flow of new software objects that need to be categorized as malicious or not.
Like reference numbers and designations in the various drawings indicate like elements.