Patent ID: 7832011

Claim:
A computer-implemented method comprising: selecting an active program on a computer system as code under investigation, wherein the program is running on an operating system of the computer system; and executing each of a first and a second plurality of detection routines on the operating system of the computer system, wherein the first plurality of detection routines are executable to determine whether the selected code under investigation has characteristics and behaviors usually associated with a valid program, wherein the second plurality of detection routines are executable to determine whether the selected code under investigation has characteristics and behaviors usually associated with a malicious program, and wherein said executing includes: applying each of the first plurality of detection routines to the code under investigation to obtain a corresponding one of a first plurality of results; and weighting each of the first plurality of results to obtain a first score indicative of whether the code under investigation is valid code; applying each of the second plurality of detection routines to the code under investigation to obtain a corresponding one of a second plurality of results; weighting each of the second plurality of results to obtain a second score indicative of whether the code under investigation is malicious code; and upon completing the executing of the first and second plurality of detection routines, using at least one of the first and second scores to categorize the code under investigation with respect to the likelihood of the code under investigation compromising the security of the computer system.