Patent ID: 11886591
Assignee: SENTINEL LABS ISRAEL LTD.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A computer-implemented method for generating a representation for behavior similarity comparison, the method comprising:
generating, by a computer system, a program-level stateful model of one or more entities in a computer operating system, the program-level stateful model comprising:
a data structure representing a state of a program, wherein the data structure comprises:
a network of one or more interconnected objects representing the one or more entities,
wherein the one or more interconnected objects are derived from a sequence of operations performed in a live environment; and
one or more object groups, wherein the one or more object groups are formed by dividing the one or more interconnected objects according to a predefined grouping rule set;

generating, by the computer system, an updated representation of the program based on the program-level stateful model;
searching, by the computer system, for at least one other representation of another program-level stateful model similar to the updated representation of the program; and
comparing, by the computer system, the updated representation of the program to the at least one other representation of another program-level stateful model, wherein the computer system comprises a processor and memory.