Threat protection network

1. A threat protection network for detecting and analyzing suspicious files in real-time, comprising:

at least one client computer connected to a network;

a server that stores threat definition data and is connected to the network;

an expert system in communication with the server;

at least one test computer connected to the expert system;

wherein the client computer is configured to identify a suspicious file on the client computer;

wherein the client computer is configured to automatically notify the server of the suspicious file;

wherein the server is configured to send the suspicious file to the expert system;

wherein the expert system is configured to determine whether the suspicious file is an actual threat by exposing the at least one test computer to the suspicious file and analyzing the behavior of the suspicious file on the at least one test computer; and

wherein the expert system is configured to isolate the expert system and the at least one test computer from the network prior to exposing the at least one test computer to the suspicious file by preventing any data from being sent to the network during the analysis of the behavior of the suspicious file on the at least one test computer.

2. The threat protection network of claim 1 , wherein the client is configured to generate a signature for the suspicious file.

3. The threat protection network of claim 2 , wherein the signature includes two or more check sums generated using the suspicious file.

4. The threat protection network of claim 1 , wherein the server is configured to update the threat definition data based upon determinations made by the expert system.

5. The threat protection network of claim 4 , wherein the server is configured to notify clients that updated threat definition data is available.

6. A threat protection network for detecting and analyzing suspicious files in real-time, comprising:

at least one client computer connected to a network;

a server that stores threat definition data and is connected to the network;

an expert system in communication with the server;

at least one test computer connected to the expert system;

wherein the client computer is configured to identify a suspicious file on the client computer;

wherein the client computer is configured to automatically notify the server of the suspicious file;

wherein the server is configured to send the suspicious file to the expert system;

wherein the expert system is configured to determine whether the suspicious file is an actual threat by exposing the at least one test computer to the suspicious file and analyzing the behavior of the suspicious file on the at least one test computer;

wherein the expert system is configured to isolate the expert system and the at least one test computer from the network prior to exposing the at least one test computer to the suspicious file;

wherein the server is configured to update the threat definition data based upon determinations made by the expert system;

wherein the server and client computers form a secure distribution network; and

wherein the updated threat definition data is distributed to client computers via the secure distribution network.

7. The threat protection network of claim 1 , wherein the server is configured to:

receive a signature of the suspicious file from the client computer;

compare the signature with threat definition data comprising signatures of known threat files;

compare the signature with data comprising signatures of suspicious files reported from other client computers; and

if the signature is not found in the signatures of suspicious files reported from other client computers:

request a copy of the suspicious file; and

receive the suspicious file.

8. The threat protection network of claim 1 :

wherein the at least one test computer includes multiple test computers;

wherein at least two of the test computers use different operating systems.

9. The threat protection network of claim 8 , wherein at least two of the test computers use different versions of the same operating system.

10. The threat protection network of claim 1 , wherein the expert system is configured to assign a score to a potential threat.

11. The threat protection network of claim 10 , wherein a score above a first threshold is indicative of an actual threat.

12. The threat protection network of claim 1 , wherein the determination of whether the suspicious file is an actual threat by the expert system is automatic.

13. A threat protection network for detecting and analyzing suspicious files in real-time, comprising:

at least one client computer connected to a network;

a server that stores threat definition data and is connected to the network;

an expert system in communication with the server; and

at least one test computer connected to the expert system;

wherein the client computer is configured to identify a suspicious file on the client computer;

wherein the client computer is configured to automatically notify the server of the suspicious file;

wherein the server is configured to send the suspicious file to the expert system;

wherein the expert system is configured to determine whether the suspicious file is an actual threat by exposing the at least one test computer to the suspicious file and analyzing the behavior of the suspicious file on the at least one test computer;

wherein the expert system is configured to isolate the expert system and the at least one test computer from the network prior to exposing the at least one test computer to the suspicious file; and

wherein the expert system is configured to refer the suspicious file to an operator in circumstances where the expert system is incapable of conclusively determining the nature of the suspicious file.

14. The computer of claim 2 , wherein:

the identified file includes a header; and

the signature includes a checksum generated using at least one bit from the file header.

15. The computer of claim 2 , wherein:

the identified file includes a header and a body; and

the signature includes a checksum generated using at least one bit from a location within the file body.

16. The computer of claim 2 , wherein:

the client computer is configured to compare the signature to:

a first set of previously generated signatures to determine whether the source is safe; and

a second set of previously generated signatures to determine whether the source is a threat; and

the client computer is configured to obtain updated threat definition data via a secure distribution network.

17. A threat identification system configured to evaluate suspicious files discovered on a remote computer system, comprising:

an expert system installed on a host computer; and

at least one test computer connected to the host computer;

wherein the expert system is configured to receive a suspicious file from a server via a network;

wherein the expert system is configured to expose the at least one test computer to the suspicious file;

wherein the expert system is configured to analyze the behavior of the suspicious file on the at least one test computer;

wherein the expert system is configured to determine a score based upon the analyzed behavior and a set of predetermined criteria; and

wherein the expert system is configured to isolate the expert system and the at least one test computer from the network prior to exposing the at least one test computer to the suspicious file.

18. The threat identification system of claim 17 , wherein the expert system determines whether the suspicious file is an actual threat based upon the score.

19. The threat identification system of claim 17 , wherein the expert system is configured to determine that:

a score above a first threshold constitutes a threat; and

a score below a second threshold constitutes no threat.

20. The threat identification system of claim 19 , wherein the first threshold and second threshold have the same value.

21. The threat identification system of claim 17 , wherein at least two of the test computers use different operating systems.

22. The threat identification system of claim 17 , wherein at least two of the test computers use different versions of the same operating system.