Patent ID: 8762948

Claim:
A system for generating a set of event filtering rules for filtering events being produced in response to emulation of a program, the system comprising: computing hardware, including a processor, a data store, and input/output facilities; an operating system executable on the computing hardware; a sample program creation module executable on the computing hardware and configured to automatically construct a plurality of sample programs based on a plurality of known program development tools, wherein the plurality of sample programs are free of malware; an emulator module executable on the computing hardware and configured to perform emulated execution of the plurality of sample programs in an isolated virtual machine environment and record events occurring in the virtual machine environment as a result of the emulated execution of the plurality of sample programs in an event log; a rule generator module executable on the computing hardware and configured to automatically formulate a set of insignificant event filtering rules for distinguishing events from among the event log that are determined to be insignificant with respect to malware detection processing to be performed.