Patent ID: 9361460
Filing Date: 2016-06-07
CPC Classification: G06F

Claim Text:
1. A method for detecting malware on a computer system, comprising: evaluating a first file on a computer system against trust criteria to determine whether the first file is compatible with the trust criteria; responsive to the first file being incompatible with the trust criteria, assigning the first file to a package of one or more files; monitoring the first file assigned to the package to determine whether the first file touches additional files on the computer system; assigning a second file on the computer system to the package responsive to the second file being touched by the first file and the second file being incompatible with the trust criteria; tracking collective behavior of the files assigned to the package; comparing the collective behavior tracked for the files assigned to the package to conditions of a malware heuristic; and determining whether to convict the package as malware based on the comparison.