Patent ID: 9390268
Filing Date: 2016-07-12
CPC Classification: G06F,H04L

Claim Text:
1. A method performed by data processing apparatus, the method comprising: identifying application signatures each representing one or more software applications, each application signature including a total score threshold and one or more sequence listing each including a plurality of sequence operations, wherein each sequence listing is associated with a sequence score; monitoring operations performed by a software application instance executed by a computing device; determining that a first operation performed by the software application instance matches a first sequence operation included in a particular sequence listing for a particular application signature; after determining that the first operation performed by the software application instance matches the first sequence operation, determining that a second operation performed by the software application instance matches a second sequence operation included in the particular sequence listing; in response to determining that the second operation matches the second sequence operation, determining that each of the plurality of sequence operations for the particular sequence listing has been observed for the software application instance; in response to determining that each of the plurality of sequence operations for the particular sequence listing has been observed, adding the sequence score to a total score for the software application instance; in response to adding the sequence score to the total score, determining that the total score for the software application instance is greater than or equal to the total score threshold for the particular application signature; and in response to determining that the total score is greater than or equal to the total score threshold, classifying the software application instance as the software application represented by the particular application signature.