METHOD FOR IDENTIFYING MALICIOUS EXECUTABLES
In a computer system, a method detects a suspected malware behavior. Activities on a computer system conducted within a given time frame are monitored during the installation of a suspected file. The monitored activities are recorded and the monitored/recorded activities are compared with patterns of malware behavior, stored in a database. Upon detecting a suspicious program, the recorded monitored activities are provided for further analysis to be performed by appropriate software removal tools.
1 . In a computer system, a method for detecting a suspected malware behavior, comprising:
a. Monitoring by an activity monitor unit which executes as a runtime process a plurality of activities on a computer system that were conducted within a given time frame during installation and execution of a suspected file or program, wherein said monitor starts prior to complete installation of the suspected file or program;
b. recording monitored activities;
c. comparing said monitored/recorded activities with malware states or operational patterns of malware behavior, stored in a database as a reference for pre-infection activities;
d. flagging to said database monitored/recorded activities that match said reference as suspicious activities; and
e. upon detecting a suspicious file or program, providing the flagged activities for further analysis to be performed by software removal tools or a security application.
2 . The method of claim 1 , wherein the activities include at least one local computer system activity.
3 . The method of claim 1 , wherein the activities include at least one network activity.
4 . The method of claim 1 , further comprising normalizing the recorded monitored activities to corresponding normalized actions.
5 . The method of claim 1 , further comprising mapping each normalized activity to a corresponding malware behavior pattern.
6 - 8 . (canceled)
9 . A non-transitory computer-readable medium whose contents allow a target computing system to:
a. monitor by an activity monitor unit which executes as a runtime process a plurality of activities during a time-bounded snapshot, the time-bounded snapshot containing the monitored activities that were conducted within a time frame of installation and execution of a suspected file or program, wherein said monitoring starts prior to completing said installation;
b. record monitored activities, in response to a notification of a suspected malware behavior;
wherein the notification of the suspected malware infection is provided by anti-malware software based on:
comparing said monitored/recorded activities with malware states or operational patterns of malware behavior, stored in a database as a reference for pre-infection activities; and
flagging to said database, monitored/recorded activities that match said reference as suspicious activities.