| 摘要 |
<p>In one aspect, a method of classifying a computer object as malware includes at a base computer (3), receiving data about a computer object from each of plural remote computers (2) on which the object or similar objects are stored and or processed. The base computer (3) comprises plural threat servers (62) arranged to receive said data from the plural remote computers (2) and apply rules and or heuristics against that data in real time to determine whether or not said object is malware and to communicate said determination to the remote computers (2). The base computer (3) comprises at least one central server (74) in communication with the threat servers (62) and arranged to receive said data about objects from the threat servers (62) to maintain a master database (71,72,73) of data received about objects from all of the threat servers (62).</p> |
