Methods and Systems of Generating Application-Specific Models for the Targeted Protection of Vital Applications

摘要

Methods, and computing devices implementing the methods, improve the efficiency and performance of a comprehensive behavioral monitoring and analysis system that is configured to predict whether a software application is causing undesirable or performance depredating behavior. The behavioral monitoring and analysis system may be configured to quickly and efficiently classify certain software applications as being benign by generating a behavior vector that characterizes the activities of the software application, determining whether the generated behavior vector includes a distinguishing behavior or behavioral clue identifying the software application as a trusted software application, and classifying the software application as benign in response to determining that the generated behavior vector includes a distinguishing behavior identifying the software application as a trusted software application.

主权项

1. A method of analyzing a software application operating in a processor of a computing device, the method comprising:
monitoring in the processor activities of the software application by collecting behavior information from a log of actions stored in a memory of the computing device; generating a behavior vector that characterizes the monitored activities of the software application based on the collected behavior information; and determining whether the generated behavior vector includes a distinguishing behavior identifying the software application as being from a known vendor.