Patent ID: 9659173
Date: 2017-05-23
CPC Classifications: G06F

Claim:
1. A method for determining, by a security application, whether an examined process code on a host computer is a malware, comprising the steps of: a. detecting by said security application whenever said examined process code performs an invocation activity that is an attempt to b. detecting a call site, being a site of an instruction within said examined process code, from which said invocation activity has been launched; c. analyzing one or more pieces of code selected in specific relation to said site from a surrounding area of said site; d. comparing at least a part of the properties of the analyzed pieces of code with a predefined software code pattern associated with malware and determining whether said examined process code corresponds to said predefined software code pattern; and e. classifying said examined process code as malware where the results of the comparing indicate that said examined process code corresponds to said predefined software code pattern.