Systems and methods for tracking malicious behavior across multiple software entities

A method comprising:

• employing at least one hardware processor of a computer system to organize a collection of
• monitored executable entities into a plurality of entity groups according to inter-entity relations selected from a group of relations consisting of a filiation relation and a code injection relation, wherein at least one entity of the collection simultaneously belongs to more than one entity group of the plurality of entity groups;
• employing the at least one hardware processor to detect an action of the at least one entity;
• in response to the detected action of the at least one entity, employing the at least one hardware processor to select a first entity group from the plurality of entity groups based on determining that the at least one entity belongs to the first entity group;
• in response to the detected action of the at least one entity, select a second entity group from the plurality of entity groups based on determining that the at least one entity belongs to the second entity group;
• and
• in response to selecting the first and second groups, employing the at least one hardware processor to determine whether the computer system comprises malware according to a first action of a first member of the first entity group, and further according to a second action of a second member of the second entity group, the first and second members distinct from the at least one entity, the first action of the first member distinct from the second action of the second member.

A non-transitory computer-readable medium storing instructions which, when executed by at least one hardware processor of a computer system, cause the computer system to form an entity manager and a scoring engine, wherein:

• the entity manager is configured to organize a collection of monitored executable software entities into a plurality of entity groups according to inter-entity relations selected from a group of relations consisting of a filiation relation and a code injection relation, wherein at least one entity of the collection simultaneously belongs to more than one entity group of the plurality of entity groups;
• and
• the scoring engine is configured, in response to a detected action of the at least one entity, to:
• select a first entity group from the plurality of entity groups based on determining that the at least one entity belongs to the first entity group,
• select a second entity group from the plurality of entity groups based on determining that the at least one entity belongs to the second entity group, and
• in response to selecting the first and second groups, determine whether the computer system comprises malware according to a first action of a first member of the first entity group, and further according to a second action of a second member of the second entity group, the first and second members distinct from the at least one entity, the first action of the first member distinct from the second action of the second member.