Patent ID: 9262635
Filing Date: 2016-02-16
CPC Classification: G06F,H04L

Claim Text:
1. A computerized method for classifying an object based on detected process operations and associated process parameters that describe the context of the process operations, comprising: receiving an object to be examined for malware; performing dynamic analysis on the object, wherein the dynamic analysis includes: processing the object within a virtual machine, detecting, by a monitor, a process operation during the processing of the object within the virtual machine, and recording the process operation and a corresponding set of process parameters associated with the process operation, wherein the set of process defines a context in which the process operation was performed within the virtual machine when the process operation was detected, wherein the recorded process operation and the set of process parameters comprise a behavior; generating a probability the behavior is suspicious based on a comparison of the recorded process operation and the set of process parameters with at least one of (i) a set of expected process operations and process parameters, or (ii) a set of anomalous process operations and process parameters; and responsive to the probability being equal to or above a first predefined level, classifying the object as malware.