System and method for detection of malware using behavior model scripts of security rating rules

Patent metadata

Field	Value
Publication number	US-8978142-B2
Application number	US-201314077688-A
Country	US
Kind code	B2
Filing date	Nov 12, 2013
Priority date	Dec 25, 2012
Publication date	Mar 10, 2015
Grant date	Mar 10, 2015

Abstract

Disclosed are systems, methods and computer program products for detecting computer malware using security rating rules. In one example, the system identifies at least one problematic security rating rule that was activated during antivirus analysis of both safe and malicious programs. The system then selects a group of programs for which said problematic rule was activated. The system then identifies in the selected group of programs a plurality of only malicious programs or the plurality of only safe programs based on the problematic security rating rule and at least one different security rating rule. The system then generates a behavior model script based on the problematic security rating rule and the at least one different security rating rule and executes said behavior model script during antivirus analysis of said analyzed program to detect a computer malware in said analyzed program.

First claim

The invention claimed is:

1. A method for detection of computer malware during antivirus analysis using security rating rules that assign security ratings to the analyzed programs, the method comprising:
identifying at least one problematic security rating rule that was activated during the antivirus analysis of one or more safe programs and one or more malicious programs;
selecting a group of programs for which said problematic security rating rule activated;
identifying in t…

Assignees

• Kaspersky Lab Zao

Inventors

• Zaitsev Oleg V

Classifications

• G06F21/566 Primary

  Physics · mapped topic

• H04L63/145 Primary

  Electricity · mapped topic