Patent ID: 11893117
Assignee: TWISTLOCK LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 9:
10. One or more non-transitory computer-readable media having program code stored thereon that is executable by a computing device, the program code comprising instructions to:
load a first application with known behavior into a controlled execution environment;
associate a software package with the first application in the controlled execution environment;
based on a plurality of rules for detecting deviations in behavior from the known behavior of the first application, evaluate behavior patterns observed during execution of the loaded first application with the associated software package;
based on a determination that one or more of the behavior patterns satisfy corresponding ones of the plurality of rules, determine that the one or more behavior patterns correspond to one or more behaviors that deviate from the known behavior of the first application and are attributable to the software package;
compute a score for the software package based on scores assigned to the one or more behaviors that deviated from the known behavior; and
determine whether the software package is malicious based on evaluation of the score computed for the software package.