Patent Document ID: 8635694
Application ID: 12631001
Patent Flag: 1

Claim One:
1. A computer-implemented method for malware classification, the method comprising: emulating, by a hardware processor, software code and recording actions of the emulated software code in an activity log; generating from the activity log an execution flow graph of the emulated software code for presentation to a human malware expert, wherein the execution flow graph visually illustrates a flow of actions performed by the emulated software code; parsing the execution flow graph of the emulated software code to identify one or more malicious behavior patterns therein; classifying the emulated software code into one or more classes of malware; and generating a graphical diagram of the malware classifications for presentation to the human malware expert, wherein the diagram visualizes the relationships between the classified software code and known malicious programs associated with the same or related classes of malware.