Patent Document ID: 9800590
Application ID: 14749683
Patent Flag: 1

Claim One:
1. A computer-implemented method for threat detection using a software program update profile, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: building an update behavioral model that identifies legitimate update behavior for a software application by: monitoring at least one client device for at least one update event associated with updating the software application prior to executing the updated software application by: monitoring at least one process to detect at least one update event initiated by the process; detecting that the update event initiated by the process modified at least one executable file; determining that the executable file is associated with the software application; and determining, based on the executable file being associated with the software application, that the update event initiated by the process is associated with the software application; and analyzing the at least one update event initiated by the process to identify the legitimate update behavior for the software application; using the update behavioral model to identify suspicious update behavior on a computing system by: detecting an instance of software application update on the computing system; comparing the instance of software application update with the legitimate update behavior identified in the update behavioral model; and determining, based on the comparison of the instance of software application update with the legitimate update behavior, that the instance of software application update is suspicious; and in response to determining that the instance of software application update is suspicious, performing a security action that blocks execution of the instance of software application update.