Patent ID: 11893117
Assignee: TWISTLOCK LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 13:
14. An apparatus comprising:
a processor; and
a computer-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
load a first application with known behavior into a controlled execution environment;
import a software package into the first application;
based on execution of the loaded first application with the imported software package, determine one or more behaviors that are attributable to the software package based on identification of deviations in behavior from the known behavior,
wherein the instructions to determine the one or more behaviors comprise instructions to evaluate of behavior patterns recorded during execution of the first application with the software package associated based on first criteria for detecting behavior deviations and determine that one or more of the behavior patterns satisfy respective ones of the first criteria;

compute a score indicative of trustworthiness of the software package based on the one or more behaviors attributable to the software package; and
based on evaluation of the score computed for the software package, determine that the software package is malicious.