Patent ID: 7779472
Filing Date: 2010-08-17
Classification: G06F

Abstract:
1. A method of detecting malware comprising: receiving a suspect executable computer file at a computer; loading said executable file into a virtual machine arranged to emulate instructions of said executable file; emulating said instructions of said executable file using said virtual machine, said emulating performed by said computer; keeping track of names of application programming interfaces (APIs) used by said executable file during said emulating, said APIs having different function, said names being stored in a memory of said computer; determining types of APIs used by said executable file based upon said determined names of APIs used, wherein each of said types of APIs represents a behavior of a group of said API names, and wherein said determining is executed by said computer; comparing said types of APIs used with a set of known behaviors, each known behavior including a list of API types used by malware; making a determination that said executable file is malware based upon said step of comparing, wherein said comparing and said determination are executed by said computer; and generating a malware alert when it is determined that said executable file is malware.