1. A method comprising: assembling a full signature definition file comprising a first received malware signature, wherein the full signature definition file further comprises a first plurality of malware signatures received up to a specified time; publishing the full signature definition file after the specified time; assembling a streaming signature definition file comprising the first received malware signature, wherein the streaming signature definition file further comprises a second plurality of malware signatures received over a first time period, the first time period begins at a first start time and ends at a first end time, and the first end time is prior to the specified time; and publishing the streaming signature definition file upon completion of the first time period.