Patent ID: 8607348

Claim:
A computer system for detecting malware in a software package on the computer system, comprising: a non-transitory computer-readable storage medium storing executable computer program modules comprising: a process monitoring module for monitoring a set of processes associated with the software package, the monitoring comprising detecting when a monitored process in the set requests access to a system process, the process monitoring module further for adding to the set of monitored processes a user process created or accessed by the monitored process; a constrained process manager for: creating a constrained process in response to the request to access the system process by modifying a constrained template process, the modification comprising modifying an address space of the constrained template process to emulate an address space of the system process; providing the constrained process to the monitored process in response to the request, the constrained process having less access to computer system resources than the system process; detecting a behavior of the system process; updating the constrained process responsive to the detected behavior of the system process; and a malware detection module for observing monitored process interactions with the address space of the constrained process and for determining whether the monitored process contains malware based at least in part on the observed interactions.