Abstract: Creating a policy to be used by a malware prevention system uses multiple events triggered by malware. A sample of malicious computer code or malware is executed in a computer system having a kernel space and a user space. Event data relating to multiple events caused by the malicious code executing on the computer system are captured and stored. The event data is configured using a specific property that facilitates malware behavior analysis. A behavior list is then created utilizing the multiple events and associated event data. The behavior list, together with data in a malware behavior database, is used to derive a policy for use in a malware prevention system. The computer system is free of any malicious code, including viruses, Trojan horses, or any other unwanted software code. The malicious computer code executes without any constraints so that the execution behavior of the malicious code may be observed and captured.

Abstract: The invention relates, in an embodiment, to a system for handling one or more pop-up messages activated by one or more applications and displayed on an output device associated with an electronic device, the electronic device is associated with an input device is provided. The system for handling pop-up messages includes an identification module to identify an active pop-message activated by an application of one or more applications. The system for handling pop-up messages also includes a recording control module to record a movement path associated with the input device. The system for handling pop-up messages also includes a translation module configured to translate recorded data pertaining to the movement path into a command pertaining to the active pop-up message.

Abstract: Multi-behavior matching in a computer system is performed in order to identify suspicious sequences of activities. System behavior is captured using driver hooks. A behavior monitoring system determines the process to which the system behavior belongs by processing a table. This includes using the process ID and thread ID of the system behavior as lookups into the table. A multi-behavior matching algorithm is applied to determine if there is any matching suspicious behavior by matching sets of rules (a policy) to system events caused by a particular process. A state machine is used to keep track of matching policies. Options to the rules and policies (such as “offset,” “depth,” “distance,” “within,” “ordered” and “occurrence/interval”) are used to refine when a rule or policy is allowed to produce a positive match, reducing false positives.