Behavior based signatures

摘要: Behavior based signatures for identifying applications are generated. An application is monitored as it runs. Specific behaviors concerning the execution of detected, and a behavior signature representing detected created, such that can be used subsequently to identify instances application. known malicious and/or non-malicious determine whether other comprise malware. To do so, running monitored, specific detected. The compared one or more signatures. Responsive match, signature, determined comprises additional malware detection test, heuristic analysis, also performed in determining