4. The method of claim 1 , further comprising scanning the database to create at least one additional behavioral signature by: identifying each behavior exhibited by at least one of the known malicious files maintained in the database; identifying each possible combination of behaviors whose number of behaviors exceeds a behavior threshold.
4. The method of claim 1 , further comprising scanning the database to create at least one additional behavioral signature by: identifying each behavior exhibited by at least one of the known malicious files maintained in the database; identifying each possible combination of behaviors whose number of behaviors exceeds a behavior threshold. 5. The method of claim 4 , further comprising: for each identified combination, determining whether the number of known malicious files that exhibit each behavior within the combination exceeds the number of known non-malicious files that exhibit each behavior within the combination by the certain threshold; creating a behavioral signature for each identified combination for which the number of known malicious files that exhibit each behavior within the combination exceeds the number of known non-malicious files that exhibit each behavior within the combination by the certain threshold.