Malicious/benign computational behavior detection using parametric behavioral pattern definition

A method comprising:

• obtaining, via a communications interface, a test pattern from a security agent operating on a monitored computing device, the test pattern including:
• a value that characterizes a portion of behavior exhibited by the monitored computing device and observed by the security agent, wherein the value is associated with an empty field of a pattern of behavior (PoB);
• making available for selection, via a display device, a plurality of behavior identifiers and a plurality of dispositions for selection;
• obtaining selections corresponding to a behavior identifier and a disposition from among the plurality of behavior identifiers and the plurality of dispositions, an individual behavior identifier of the plurality of behavior identifiers being associated with one or more dispositions;
• based at least in part on obtaining the selections, creating a definition that includes the behavior identifier, the disposition, and the value;
• and
• transmitting, via the communications interface, the definition to the security agent.

A non-transitory computer-readable medium having processor-executable instructions store thereon that, when executed by one or more processors, cause the processors to perform operations comprising:

• receiving, via a communications interface, a definition file including a first value corresponding to an empty field of a pattern of behavior (PoB), wherein the empty field was generated by removing a portion of the PoB;
• receiving behavior information regarding behavior exhibited by a computing device and corresponding to the PoB;
• determining a test pattern based at least in part on the behavior information and detecting that the behavior information corresponds with at least part of the PoB;
• and
• determining whether the test pattern matches a first union of the PoB with the empty field populated by the first value.