Patent ID: 8434151

Claim:
A method for detecting a malicious software component, the method comprising: a computer receiving a request to execute a potentially malicious software component in the computer or to write the potentially malicious software component to storage in the computer; responsive to receiving the request, the computer initiating execution of the potentially malicious software component in an emulated data processing system, the emulated data processing system isolating the potentially malicious software component from one or more other software components that are called by the potentially malicious software component such that if the potentially malicious software component is malicious, it will not damage the other software components; while executing the potentially malicious software component in the emulated data processing system, the potentially malicious software component making a series of calls specified by the potentially malicious software component to the emulated data processing system; the computer monitoring the series of calls made by the potentially malicious software component to the emulated data processing system to determine a respective series of call types to the other software components named in the series of calls; the emulated data processing system executing the series of calls; the computer determining whether the respective series of call types is indicative of a malicious behavior based on a comparison of the respective series of call types to a set of pre-determined call patterns indicative of malicious behavior for the potentially malicious software component; and allowing the request in response to determining the respective series of call types to the other software components named in the series of calls is not indicative of the malicious behavior.