Patent ID: 7832011
Filing Date: 2010-11-09
Classification: G06F

Abstract:
1. A computer-implemented method comprising: selecting an active program on a computer system as code under investigation, wherein the program is running on an operating system of the computer system; and executing each of a first and a second plurality of detection routines on the operating system of the computer system, wherein the first plurality of detection routines are executable to determine whether the selected code under investigation has characteristics and behaviors usually associated with a valid program, wherein the second plurality of detection routines are executable to determine whether the selected code under investigation has characteristics and behaviors usually associated with a malicious program, and wherein said executing includes: upon completing the executing of the first and second plurality of detection routines, using at least one of the first and second scores to categorize the code under investigation with respect to the likelihood of the code under investigation compromising the security of the computer system.