1. A computer-implemented method for creating behavioral signatures used to detect malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: maintaining a database that identifies: known malicious files and behaviors exhibited by the known malicious files; known non-malicious files and behaviors exhibited by the known non-malicious files; creating a behavioral signature used to detect malware by: determining a combination of behaviors exhibited by at least one of the known malicious files identified within the database; identifying the number of known malicious files that exhibit each behavior within the combination of behaviors; identifying the number of known non-malicious files that exhibit each behavior within the combination of behaviors; determining that the number of known malicious files that exhibit each behavior within the combination exceeds the number of known non-malicious files that exhibit each behavior within the combination by a certain threshold; incorporating representations of each behavior within the combination of behaviors into the behavioral signature.
1. A computer-implemented method for creating behavioral signatures used to detect malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: maintaining a database that identifies: known malicious files and behaviors exhibited by the known malicious files; known non-malicious files and behaviors exhibited by the known non-malicious files; creating a behavioral signature used to detect malware by: determining a combination of behaviors exhibited by at least one of the known malicious files identified within the database; identifying the number of known malicious files that exhibit each behavior within the combination of behaviors; identifying the number of known non-malicious files that exhibit each behavior within the combination of behaviors; determining that the number of known malicious files that exhibit each behavior within the combination exceeds the number of known non-malicious files that exhibit each behavior within the combination by a certain threshold; incorporating representations of each behavior within the combination of behaviors into the behavioral signature. 4. The method of claim 1 , further comprising scanning the database to create at least one additional behavioral signature by: identifying each behavior exhibited by at least one of the known malicious files maintained in the database; identifying each possible combination of behaviors whose number of behaviors exceeds a behavior threshold.