US Patent 9591019 Malicious object detection

Malicious object detection is disclosed. An apparatus includes one or more processors, and one or more memories including computer program code. The one or more memories and the computer program code are configured to, with the one or more processors, cause the apparatus at least to perform: obtain image data; obtain association data relating to the image data; identify the image data as corresponding to an identified image among known reference images; and set reputation data of the association data as suspicious, if the association data does not match acceptable associations for the identified image.