Patent ID: 9361459
Filing Date: 2016-06-07
CPC Classification: G06F,H04L

Claim Text:
1. A method of classifying malicious computer code, the method comprising: monitoring, by one or more computing processors, execution in a computing environment of a computer program comprising suspicious computer code; detecting, by at least one of the one or more computing processors, access by the computer program of an item of environmental information for the computing environment; identifying a branch in the computer program where the branch is based on a value of the accessed item of environmental information; identifying a plurality of execution paths in the computer program stemming from the identified branch in the computer program; causing execution of the plurality of execution paths by: determining, based on the execution of the plurality of execution paths, that a first execution path in the plurality of execution paths results in benign behavior and that a second execution path in the plurality of execution paths results in malicious behavior; and classifying the computer program as evasive malware responsive to the determining.