Patent ID: 8626935

Claim:
A computer-implemented method comprising: receiving, by a configured computing system, a communication from an executing copy of a software application; obtaining, by the configured computing system, information specific to the executing copy of the software application; generating, by the configured computing system, an identifier to represent the executing copy of the software application based at least in part on the obtained information; determining, by the configured computing system, whether the generated identifier corresponds to any stored identifiers for any software application copies that were previously identified as suspect, the determining including comparing the generated identifier to previously stored identifiers for software application copies that were previously identified as suspect in order to determine whether a degree of match between two identifiers being compared exceeds a similarity threshold; and if the generated identifier is determined to correspond to any stored identifier for any software application copies that were previously identified as suspect, providing an indication that the received communication is suspect, and otherwise not providing the indication that the received communication is suspect.