Patent ID: 8621632
Filing Date: 2013-12-31
Classification: G06F,H04L

Abstract:
1. A computer-implemented method for locating malware, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: identifying a malicious behavior in a computing system; determining that the malicious behavior arises from a set of interrelated executable objects that is behaviorally opaque such that the set of interrelated executable objects obscures which executable object in the set is responsible for the malicious behavior, wherein the set of interrelated executable objects comprises an executable program and each executable object within the set of interrelated executable objects comprises an executable module used by the executable program such that the set of interrelated executable objects runs as a single process where each executable object in the set of interrelated executable objects is a component of the single process that loads into the single process; identifying an executable object recently added to the set of interrelated executable objects; attributing the malicious behavior to the recently added executable object based on when the recently added executable object was added to the set of interrelated executable objects; performing a security action on the recently added executable object.