System and method for detecting multi-component malware

1. A method for detecting malicious program behavior, the method comprising:

emulating at least a part of a computer program in an isolated computing environment,

detecting events being generated by one or more executable components of the emulated computer program;

determining, substantially in real time, whether one or more detected events are associated with a malicious program behavior;

storing in a data structure only detected events associated with the malicious program behavior; and

comparing events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program.

2. The method of claim 1 , wherein individually one or more executable components of a malicious computer program exhibit benign behavior.

3. The method of claim 2 , further comprising continuing emulation of the computer program even when one or more executable components are terminated.

4. The method of claim 3 , wherein detecting an event generated by an executable component of the computer program includes detecting at least one of one or more program's system calls and one or more system responses to the program's system calls.

5. The method of claim 4 , wherein emulating an executable component includes one or more of

emulating a main process of the computer program;

emulating one or more child processes of the computer program;

emulating one or more threads of the computer program; and

emulating one or more remote threads of the computer program.

6. The method of claim 5 , wherein emulating two or more executable components of the computer program includes one or more of emulating at least two or more executable components sequentially and emulating at least two or more executable components in parallel.

7. The method of claim 1 , wherein the isolated computing environment includes at least a part of a virtual multitasking computer system.

8. A system for detecting malicious program behavior, the system comprising:

a system memory; and

a processor operably coupled to the system memory and configured to

emulate in the system memory at least a part of a computer program;

detect events being generated by one or more executable components of the emulated computer program;

determine, substantially in real time, whether one or more detected events are associated with a malicious program behavior;

store in a data structure in the system memory only detected events associated with the malicious program behavior; and

compare events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program.

9. The system of claim 8 , wherein individually one or more executable components of a malicious computer program exhibit benign behavior.

10. The system of claim 9 , wherein the processor is further configured to continue emulating the computer program even when one or more executable components are terminated.

11. The system of claim 10 , wherein the processor is further configured to detect at least one of one or more program's system calls and one or more system responses to the program's system calls.

12. The system of claim 11 , wherein an executable component includes one or more of

a main process of the computer program;

one or more child processes of the computer program;

one or more threads of the computer program; and

one or more remote threads of the computer program.

13. The system of claim 12 , wherein emulation of two or more executable components of the computer program includes emulation of at least two or more executable components sequentially and emulation of at least two or more executable components in parallel.

14. The system of claim 8 , wherein the processor is operable to emulate at least a part of the computer program in a virtual multitasking computer system.

15. A computer-readable medium comprising computer-executable instructions for detecting malicious program behavior, the computer-executable instructions include:

instructions for emulating at least a part of a computer program in an isolated computing environment,

instructions for detecting events being generated by one or more executable components of the emulated computer program;

instructions for determining, substantially in real time, whether one or more detected events are associated with a malicious program behavior;

instructions for storing in a data structure only detected events associated with the malicious program behavior; and

instructions for comparing events stored in the data structure for the emulated computer program with one or more event patterns associated with the malicious program behaviors to detect malicious program behavior of the emulated computer program.

16. The computer-readable medium of claim 15 , wherein individually one or more executable components of a malicious computer program exhibit benign behavior.

17. The computer-readable medium of claim 16 , further including instructions for continuing emulating the computer program even when emulation of one or more executable components is terminated.

18. The computer-readable medium of claim 17 , wherein detecting an event generated by an executable component of the computer program includes detecting at least one of one or more program's system calls and one or more system responses to the program's system calls.

19. The computer-readable medium of claim 18 , wherein instructions for emulating two or more executable components include instructions for emulating two or more executable components sequentially and instructions for emulating two or more executable components in parallel.

20. The computer readable medium of claim 15 , wherein the isolated computing environment includes at least a part of a virtual multitasking computer system.