Patent ID: 8607340
Filing Date: 2013-12-10
Classification: G06F

Abstract:
1. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of: A) monitoring a user interaction with a computer, the user interaction including a plurality of user behaviors by a single user during a usage session, for a first indication of a user behavior, wherein the first indication of the user behavior is a result of comparing the user interaction with one of a plurality of predetermined behaviors, referred to as behavioral genes, where each one of the behavior genes is stored for reference in a database; B) monitoring a computer code process executing during the usage session for a first indication of a first code operation, wherein the first indication of the first code operation is a result of comparing the first code operation with one of a plurality of predetermined code behaviors, referred to as code genes, where each one of the code genes is stored for reference in a database; C) performing step B) a number of times to collect a first plurality of code operation indications; D) comparing a combination of the first indication of user behavior and the first plurality of code operation indications to a first predetermined collection of user behavior-code operation indications, referred to as a phenotype, which comprises a grouping of specific behavioral and code genes that are typically present in a type of malicious usage session with a computer; E) based on a detection of a collection of known malicious behaviors in step D), performing the following steps to obtain an increased level of confidence that a known family of malware is present: F) causing an action based on a prediction that the user interaction is the type of malicious usage session as indicated by the second phenotype.