Patent Document ID: 8955138
Application ID: 13939600
Patent Flag: 1

Claim One:
1. A computer-implemented method for reevaluating apparently benign behavior on computing devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving a plurality of reports from a plurality of computing systems that indicate that an attack that targeted each of the plurality of computing systems reached a specific stage on each of the plurality of computing systems; identifying behavioral data that comprises, for each computing system within the plurality of computing systems, a plurality of activities that the computing system observed before the attack reached the specific stage on the computing system, wherein the plurality of activities are of a type of activity that is relevant to detecting a prior stage of the attack that precedes the specific stage of the attack; analyzing the behavioral data to correlate the attack with at least one activity observed before the attack reached the specific stage on at least one of the plurality of computing systems; determining that the activity is suspect based at least in part on correlating the attack with the activity.