Software program identification based on program behavior

摘要

Operations performed by a software application instance executed by a computing device are monitored. A determination is made that a particular operation performed matches an application signature representing a particular software application. In response, a match score is added to a total score for the software application. In response to determining that the total score is greater than or equal to a threshold, the software is classified.

主权项

1. A method performed by data processing apparatus, the method comprising:
identifying application signatures each representing one or more software applications, wherein each application signature includes operations each associated with a match score, and each application signature includes a total score threshold; monitoring operations performed by a software application instance executed by a computing device; determining that a particular operation performed by the software application instance matches an operation included in a particular application signature representing a particular software application; in response to determining that the particular operation matches the operation included in the particular application signature, adding a match score associated with the particular operation to a total score associated with the software application instance; in response to adding the match score to the total score, determining that the total score for the software application instance is greater than or equal to the total score threshold for the particular application signature; and in response to determining that the total score is greater than or equal to the total score threshold, classifying the software application instance as the particular software application represented by the particular application signature.