Blackbox program privilege flow analysis with inferred program behavior context

1. A non-transitory computer-readable storage medium comprising a computer-readable program for performing privilege flow analysis, wherein the computer-readable program when executed on a computer causes the computer to perform the steps of:

monitoring at least one program operating system (OS) event handled by a program;

generating a privilege flow graph of the program;

determining an inferred program behavior context of the program; and

generating, based on a combination of the privilege flow graph and the inferred program behavior context, an inferred behavior context-aware privilege flow graph of the program to distinguish different roles of processes and/or threads within the program;

wherein the privilege flow graph is a state transition diagram of privileges of the program in terms of multiple OS data fields related to the privileges and summarizes transitions of privileges which the program may repeat;

wherein the inferred program behavior context is an inferred identity of the processes and/or thread of the program based on behavior patterns;

wherein the inferred program behavior context distinguishes different behavior characteristics and roles within the program;

wherein the behavior characteristics and roles are distinguished based on a program hierarchy level and system call characteristics; and

wherein, if the program detects a privilege behavior outside of the inferred behavior context-aware privilege flow graph, such privilege behavior is labeled as an anomaly, and if the privilege behavior is not outside of the inferred behavior context-aware privilege flow graph, such privilege behavior is not labeled as an anomaly.