Patent Document ID: 9241010
Application ID: 14221199
Patent Status: 1

Claim One:
1. A computer-implemented method for detecting malicious behavior, comprising: processing a malicious content suspect within a virtual machine that simulates a target operating environment associated with the malicious content suspect; receiving a communication response object as a result of processing the malicious content suspect; parsing the communication response object into at least a first sub-object and a second sub-object; sending the first sub-object to a first communication behavior detector in response to determining the first sub-object is a compatible input for the first communication behavior detector; sending the second sub-object to a second communication behavior detector in response to determining the second sub-object is a compatible input for the second communication behavior detector; determining, by the first communication behavior detector, a first behavior match result for the first sub-object of the communication response object; determining, by the second communication behavior detector, a second behavior match result for the second sub-object of the communication response object; aggregating the first behavior match result with the second behavior match result, wherein a malicious behavior score is calculated according to an aggregated result from all matches; and classifying the malicious content suspect according to the malicious behavior score.