Patent Document ID: 9769195
Application ID: 14687944

Base Claim:
1. A computer-implemented method for efficiently allocating resources for behavioral analysis, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: determining a file type of a first file subject to behavioral analysis; loading the first file within an environment for behavioral analysis to observe at least one behavior within the environment attributable to the first file; observing a malicious behavior within the environment and attributing the malicious behavior to the first file; determining a timing of the malicious behavior after loading the first file within the environment; limiting an amount of time dedicated to analyzing a second file within the environment based at least in part on the timing of the malicious behavior after loading the first file within the environment and due to the second file being of the same file type as the first file.

---

Claim 3:
3. The computer-implemented method of claim 1 , wherein limiting the amount of time dedicated to analyzing the second file within the environment is based at least in part on timing information of observed malicious behaviors after loading each of a plurality of files of the file type.