Patent ID: 7913305

Claim:
A malware detection system for determining whether a code module is malware according to the code module's exhibited behaviors, the system comprising memory storing the following computer executable components: at least one dynamic behavior evaluation module, wherein each dynamic behavior evaluation module provides a virtual environment for executing a code module of a particular type, and wherein each dynamic behavior evaluation module records interesting API function calls that the code module makes as it is executed, wherein the interesting API function calls are specified by a user and comprise a portion of all API function calls that the code module makes, wherein only the interesting API function calls, but not all API function calls, that the code module makes during execution in the dynamic behavior evaluation module are recorded into a behavior signature corresponding to the code module; a management module, wherein the management module obtains the code module, and wherein the management module evaluates the code module to determine the code module's type, and wherein the management module selects a dynamic behavior evaluation module to execute the code module according to the code module's type; a malware behavior signature store storing at least one known malware behavior signature of a known malware, wherein each of the at least one known malware behavior signature is comprised of only the interesting API function calls as specified by the user; a behavior signature comparison module that obtains the behavior signature of the code module and compares the behavior signature of the code module to the known malware behavior signatures in the malware behavior signature store to determine whether the interesting API function calls recorded in the behavior signature of the code module match the interesting API function calls in any of the known malware behavior signatures; and wherein the malware detection system is configured to report whether the code module is a known malware based at least in part on the degree that the interesting API function calls recorded in the behavior signature of the code module match the interesting API function calls in a behavior signature of the known malware.