Patent ID: 7487543

Claim:
A method for the automatic determination of potentially worm-like behavior of a program, comprising: determining a behavioral profile of the program in an environment that does not emulate the operation of a network, where determining the behavioral profile comprises executing the program in at least one known non-network environment and further comprises: using an automated method for examining the environment and determining what changes, if any, have occurred in the environment; recording any determined changes as said behavioral profile; in response to the program seeking to determine information about a file, creating the file before returning the file to the program as an inducement for the program to display worm-like behavior; in response to the program seeking to determine information about an electronic mail program, returning the information to the program as an inducement for the program to display worm-like behavior; and determining a dynamic link library usage of the program; comparing the determined behavioral profile against a profile indicative of worm-like behavior; and providing an indication of potentially worm-like behavior based on the result of the comparison.