Patent ID: 8640240

Claim:
A device for using information on malicious application behaviors, the device comprising: a capability-monitoring unit that monitors application capabilities of a malicious application; a behavior-monitoring unit that monitors application behaviors of the malicious application; an a malicious Behavior Description Language (mBDL)-generating unit that generates a document in a formal language specifying the monitored application capabilities and the monitored application behaviors; a controlling unit that controls execution of the malicious application using the generated document in the formal language; and a network-administering unit that transmits the document in the formal language, which is generated in the mBDL-generating unit, to other devices, wherein at least one of the capability-monitoring unit, the behavior-monitoring unit, the mBDL-generating unit, and the controlling unit is implemented as a hardware processor, wherein the application is a previously generated malicious application received by the device.