Patent ID: 9231969
Filing Date: 2016-01-05
CPC Classification: G06F,H04L

Claim Text:
1. A computer implemented method for tracking security risks of a polymorphic file by tracking static objects generated by the polymorphic file, the method comprising the steps of: tracking, by a computer, a first object created by a first mutation of a polymorphic file at a first time wherein the polymorphic file has not been previously identified as comprising malware and said first object is tracked for performing a malware service; determining whether a security reputation for the first object meets a security threshold; determining, by a computer, a security risk of the polymorphic file that created the first object based on the security reputation of the first object, wherein, responsive to a determination that the security reputation for the first object meets the predetermined security threshold, the polymorphic file is determined to comprise malware if it meets a security threshold determined based on at least one of: the number of distinct first objects created by the polymorphic file and the number of times a distinct first object is created by the polymorphic file; storing, by a computer, the security reputation for the first object in a database; linking, by a computer, a second mutation of the polymorphic file to the first mutation by subsequently identifying the first object created by a second mutation of the polymorphic file at a second time; and receiving, by a computer, the security risk of the polymorphic file that created the first object at the first and second times based on the determined security reputation of the first object.