System and method for behavioral analysis of suspicious events and malicious applications in computer systems

A non-transitory computer readable medium containing a set of instructions that, when executed by a processor, cause the processor to:

• receive data capturing a run time behavior of a binary object;
• extract the data from the run time behavior of the binary object;
• map the extracted data into one or more interactive visual representations of the run time behavior of the binary object comprising a scalar representation of process calls, dependencies among processes and executable files, or time dependencies between the processes and the executable files;
• and
• classify the binary object as malicious or benign.

A system comprising:

• a database;
• a memory;
• and
• one or more processors communicably coupled to the database and the memory, wherein the one or more processors receive data capturing a run time behavior of a binary object, extract the data from the run time behavior of the binary object, map the extracted data into one or more interactive visual representations of the run time behavior of the binary object comprising a scalar representation of process calls, dependencies among processes and executable files, or time dependencies between the processes and the executable files, and classify the binary object as malicious or benign.