System and method for dynamically detecting computer viruses through associative behavioral analysis of runtime state

A method for dynamically detecting computer viruses through associative behavioral analysis of runtime state, comprising:

• defining a group of monitored events, each monitored event comprising a set of one or more actions defined within an object, each action being performed by one or more applications executing within a defined computing environment;
• continuously monitoring runtime state within the defined computing environment for an occurrence of any one of the monitored events in the group;
• tracking a sequence of execution of the monitored events for each of the applications;
• identifying each occurrence of a specific event sequence characteristic of behavior of a computer virus and the application which performed the specific event sequence;
• creating a histogram describing the specific event sequence occurrence for each of the applications;
• identifying repetitions of the histogram associated with at least one object;
• organizing the histograms into plurality of records ordered by object, application, and monitored event;
• maintaining a structured database in which the plurality of records is stored;
• storing each histogram for each such specific event sequence occurrence in one such database record identified by the application by which the specific event sequence was performed;
• configuring the structured database as an event log organized by each event in the group of monitored events;
• and
• updating the database record storing each specific event sequence occurrence with a revised histogram as each such occurrence is identified.

A computer-readable storage medium holding code for dynamically detecting computer viruses through associative behavioral analysis of runtime state, comprising:

• defining a group of monitored events, each monitored event comprising a set of one or more actions defined within an object, each action being performed by one or more applications executing within a defined computing environment;
• continuously monitoring runtime state within the defined computing environment for an occurrence of any one of the monitored events in the group;
• tracking a sequence of execution of the monitored events for each of the applications;
• identifying each occurrence of a specific event sequence characteristic of behavior of a computer virus and the application which performed the specific event sequence;
• creating a histogram describing the specific event sequence occurrence for each of the applications;
• identifying repetitions of the histogram associated with at least one object;
• organizing the histograms into plurality of records ordered by object, application, and monitored event;
• maintaining a structured database in which the plurality of records is stored;
• storing each histogram for each such specific event sequence occurrence in one such database record identified by the application by which the specific event sequence was performed;
• configuring the structured database as an event log organized by each event in the group of monitored events;
• and
• updating the database record storing each specific event sequence occurrence with a revised histogram as each such occurrence is identified.