Patent Document ID: 7809670
Application ID: 11608625
Patent Flag: 1

Claim One:
1. A computer system for an application group classification, the computer system comprising: one or more databases for including a plurality of application groups and a set of application classifying rules, wherein each application group has been classified based on the set of application classifying rules and includes one or more member applications sharing a set of common behavior patterns according to an event sequence, wherein each event includes information about the event's action including event object information, event subject information, action parameters and status of the action; and a computing device, in communication with the one or more databases, that performs the following: receives a request to classify an application into a corresponding application group among the plurality of application groups; obtains an event sequence according to a predefined specific set of events that identify two or more specified malware features, the predefined events including at least one of “registry open,” “registry write,” “registry query,” “file open,” “file write,” “virtual memory allocation,” “virtual memory write,” “network access,” and “process open,” wherein the event sequence is collected while the application is being executed, and wherein the collected events are ordered according to the time of the occurrence of program actions and environment state transitions; determines the corresponding application group for the application by applying the set of application classifying rules to the obtained event sequence; and provides information about the determined application group as a response to the request.