Patent ID: 8484727

Claim:
A computer-based system for detecting malicious programs, the system comprising: a processing system having at least one processor configured to: receive a plurality of events of program execution; classify the received events as malicious or non-malicious; collect information about unclassifiable events, said unclassifiable events include events that cannot be classified as malicious or non-malicious with a predefined degree of certainty; format the collected event-related information for presentation to a program analyst, wherein formatting comprises: generating a list of unclassifiable events; removing duplicate events from the generated list; providing program code associated with one or more listed events; and providing reference information about one or more listed events, including one or more of (i) malicious behavior patterns associated with one or more events, and (ii) family of functions, objects and programs associated with one or more events; and an analyst workstation connected to the processing system, the workstation including: a head-mounted video display with headphones for isolating the program analyst from external audiovisual stimuli and displaying the list of unclassifiable events and the formatted event-related information to the program analyst; and a user input device operable to receive analyst's physiological response indicative of whether the displayed unclassifiable events are malicious, wherein the user input device includes one or more of (i) a push-button device responsive to analyst's finger movements; (ii) a pressure sensor responsive to analyst's finger movements; (iii) a video camera monitoring analyst's eye movements; (iv) an audio sensor detecting analysis voice commands; and (v) an electrical sensor monitoring analyst's biosignals.