Patent Document ID: 9223963
Application ID: 13898284
Patent Flag: 1

Claim One:
1. A method for dynamically determining an execution environment in a system having a plurality of execution environments including a first execution environment and a second execution environment, the second execution environment being a protected execution environment, the method comprising: performing behavioral analysis on an executable application prior to each execution of the executable application, comprising: requesting behavioral information regarding prior performance of suspicious or out of policy activities of the executable application from a remote security database prior to each execution of the executable application; and evaluating the behavioral information obtained responsive to the request; determining an initial execution environment based on the behavioral analysis prior to each execution of the executable application, comprising: determining a first portion of a single execution of the executable application for execution in the first execution environment and a second portion of the single execution for execution in the second execution environment; and determining the initial execution environment as one of the first execution environment and the second execution environment; loading the executable application for execution in the initial execution environment; collecting behavioral characteristics of the executable application as it is executed within the initial execution environment; and determining from the collected behavioral characteristics whether execution of the executable application should be moved from the initial execution environment to a secondary execution environment while the executable application is still executing in the initial execution environment, wherein only one of the initial execution environment and the secondary execution environment is a protected execution environment.