12. The system of claim 9 , wherein the signature module further scans the database to create at least one additional behavioral signature by: identifying each behavior exhibited by at least one of the known malicious files maintained in the database; identifying each possible combination of behaviors whose number of behaviors exceeds a behavior threshold.
12. The system of claim 9 , wherein the signature module further scans the database to create at least one additional behavioral signature by: identifying each behavior exhibited by at least one of the known malicious files maintained in the database; identifying each possible combination of behaviors whose number of behaviors exceeds a behavior threshold. 13. The system of claim 12 , wherein the signature module further: determines, for each identified combination, whether the number of known malicious files that exhibit each behavior within the combination exceeds the number of known non-malicious files that exhibit each behavior within the combination by the certain threshold; creates a behavioral signature for each identified combination for which the number of known malicious files that exhibit each behavior within the combination exceeds the number of known non-malicious files that exhibit each behavior within the combination by the certain threshold.