Patent Document ID: 9411959
Application ID: 14502713
Patent Status: 1

Claim One:
1. A security device, comprising: one or more processors to: receive actual behavior information associated with an object, from a user device, the actual behavior information identifying a first set of behaviors associated with executing the object in a live environment at the user device; receive a memory snapshot associated with executing the object in the live environment, the memory snapshot corresponding to a memory space associated with executing the object in the live environment; perform an analysis of the object based on the memory snapshot, the analysis being performed such that the memory space is re-established within a test environment at the security device, and the analysis being associated with identifying whether the object is an evasive malicious object; determine test behavior information associated with the object, the test behavior information identifying a second set of behaviors associated with testing the object in the test environment, and the test environment including a sandbox environment; compare the first set of behaviors and the second set of behaviors to determine a difference between the first set of behaviors and the second set of behaviors; identify whether the object is the evasive malicious object based on the difference between the first set of behaviors and the second set of behaviors, the object being identified as the evasive malicious object based on: the first set of behaviors including a malicious behavior, and the second set of behaviors not including the malicious behavior; and provide an indication that the object is the evasive malicious object based on identifying the object as the evasive malicious object.