Patent ID: 8713680

Claim:
A method of modeling a behavior of a computer program that is executed in a computer system with a hardware processor configured to model the behavior of the computer program, the method comprising: the processor collecting system use information about resources of the computer system that the computer program is configured to use, wherein the collecting of the system use information includes collecting a plurality of system use information at different times; extracting the behavior signature includes generating a plurality of operational functions about the computer program based on a correlation between the plurality of collected system use information; the processor extracting a first and second behavior signature of the computer program from the collected system use information; and the processor encoding the extracted first and second behavior signature to generate a first and second behavior vector wherein encoding includes encoding a similarity between the first behavior signature and the second behavior signature that is inversely proportional to a distance between the first behavior vector corresponding to the first behavior signature and the second behavior vector corresponding to the second behavior signature wherein the first behavior signature of the computer program is data used to train a malicious program detection program to discriminate a malicious program from a normal program; wherein encoding the extracted behavior signature to generate the behavior vector includes encoding a plurality of elements that respectively corresponds to combinations of two random operational functions among the plurality of operational functions, and storing a temporal precedence relation between the two operational functions in each of the elements.