Patent ID: 7559086

Claim:
A computer-implemented method for detecting malicious program behavior, comprising: emulating at least a part of a computer system in an isolated computer environment; emulating execution of the computer program in the isolated computer environment, including emulating execution of one or more remote threads of the computer program; detecting events being generated by the one or more remote threads of the emulated computer program; determining, substantially in real time, whether each detected event is associated with malicious program behaviors; storing in a data structure only detected events associated with the malicious program behaviors; comparing a totality of events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors; and terminating emulation of the computer program if, based on the comparison, the totality of events stored in the data structure for the emulated computer program corresponds to one of the event patterns associated with the malicious program behaviors.