Patent ID: 8117656

Claim:
A non-transitory computer-readable medium configured by software code for performing an activities-to-code method for identifying spyware candidates, the method comprising the steps of: automatically monitoring network transmission activities of a device and recording the identities of processes which perform said network transmission activities; automatically monitoring user update activities of the device, namely, activities that write to a screen of the device and/or send output to a speaker of the device, and recording the identities of processes which are not surreptitious because they indicate their presence to a user of the device by performing said user update activities; identifying at least one spyware candidate by automatically comparing recorded identities of processes which perform network transmission activities with recorded identities of processes which perform user update activities, to determine whether any group of one or more related processes performed at least one network transmission activity and did not perform any substantive user update activities; and automatically identifying as a spyware candidate at least one group of one or more related processes which performed network transmission activities and did not perform any substantive user update activities; wherein the method automatically identifies a group of one or more related processes which performed network transmission activities and did not perform any user update activities.