System and method for increasing heuristics suspicion levels in analyzed computer code

A system for selecting a detection method for analyzing computer code for malicious code, comprising:

• means for storing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods require different amounts of time to analyze for malicious code;
• means for selecting a fastest one of the malicious code detection methods;
• means for analyzing computer code for malicious code using the selected malicious code detection method and outputting a result of the analysis;
• means for determining a probability of accuracy of the result of the analysis;
• means for selecting a next fastest one of the malicious code detection methods and repeating the analyzing and determining, if the probability of accuracy is below a predetermined level;
• and
• outputting a result of the analysis if the probability of accuracy is at or above the predetermined level.

A storage medium including computer executable code for selecting a detection method for analyzing computer code for malicious code, the computer executable code comprising:

• code including a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods require different amounts of time to analyze for malicious code;
• code for selecting a fastest one of the malicious code detection methods;
• code for analyzing computer code for malicious code using the selected malicious code detection method;
• code for determining a probability of accuracy of a result of the analysis;
• code for selecting a next fastest one of the malicious code detection methods and repeating the analyzing and determining steps, if the probability of accuracy is below a predetermined level;
• and
• code for outputting a result of the analysis if the probability of accuracy is at or above the predetermined level.

A programmed computer system including computer executable code for selecting a detection method for analyzing computer code for malicious code, the system comprising:

• storage for storing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods require different amounts of time to analyze for malicious code;
• a unit for reading and executing computer executable code, the computer executable code comprising,
• code for selecting a fastest one of the malicious code detection methods,
• code for analyzing computer code for malicious code using the selected malicious code detection method,
• code for determining a probability of accuracy of a result of the analysis, and
• code for selecting a next fastest one of the malicious code detection methods and repeating the analyzing and determining steps, if the probability of accuracy is below a predetermined level;
• and
• an output unit for outputting a result of the analysis if the probability of accuracy is at or above the predetermined level.

A method of selecting a detection method for analyzing computer code for malicious code, comprising:

• providing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods have different expected degrees of accuracy when analyzing for malicious code;
• selecting a malicious code detection method having a lowest expected degree of accuracy;
• analyzing computer code for malicious code using the selected malicious code detection method;
• determining an actual probability of accuracy of a result of the analysis;
• selecting a next least accurate malicious code detection method and repeating the analyzing and determining steps, if the actual probability of accuracy is below a predetermined level;
• and
• outputting a result of the analysis if the actual probability of accuracy is at or above the predetermined level.

A system for selecting a detection method for analyzing computer code for malicious code, comprising:

• means for storing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods have different expected degrees of accuracy when analyzing for malicious code;
• means for selecting a malicious code detection method having a lowest expected degree of accuracy;
• means for analyzing computer code for malicious code using the selected malicious code detection method and outputting a result of the analysis;
• means for determining an actual probability of accuracy of the result of the analysis;
• means for selecting a next expected least accurate malicious code detection method and repeating the analyzing and determining, if the actual probability of accuracy is below a predetermined level;
• and
• outputting a result of the analysis if the actual probability of accuracy is at or above the predetermined level.

A storage medium including computer executable code for selecting a detection method for analyzing computer code for malicious code, the computer executable code comprising:

• code including a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods have different expected degrees of accuracy when analyzing for malicious code;
• code for selecting a fastest one of the malicious code detection methods;
• code for analyzing computer code for malicious code using the selected malicious code detection method;
• code for determining an actual probability of accuracy of a result of the analysis;
• code for selecting a next expected least accurate malicious code detection method and repeating the analyzing and determining steps, if the actual probability of accuracy is below a predetermined level;
• and
• code for outputting a result of the analysis if the actual probability of accuracy is at or above the predetermined level.

A programmed computer system including computer executable code for selecting a detection method for analyzing computer code for malicious code, the system comprising:

• storage for storing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods have different expected degrees of accuracy when analyzing for malicious code;
• a unit for reading and executing computer executable code, the computer executable code comprising,
• code for selecting a malicious code detection method having a lowest expected degree of accuracy,
• code for analyzing computer code for malicious code using the selected malicious code detection method,
• code for determining an actual probability of accuracy of a result of the analysis, and
• code for selecting a next expected least accurate malicious code detection method and repeating the analyzing and determining steps, if the actual probability of accuracy is below a predetermined level;
• and
• an output unit for outputting a result of the analysis if the actual probability of accuracy is at or above the predetermined level.

A method of selecting a detection method for analyzing computer code for malicious code, comprising:

• providing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods require use of different amounts of computer resources to analyze for malicious code;
• selecting a malicious code detection method requiring use of the least amount of computer resources;
• analyzing computer code for malicious code using the selected malicious code detection method;
• determining a probability of accuracy of a result of the analysis;
• selecting a malicious code detection method requiring the use of the next least amount of computer resources and repeating the analyzing and determining steps, if the probability of accuracy is below a predetermined level;
• and
• outputting a result of the analysis if the probability of accuracy is at or above the predetermined level.

A system for selecting a detection method for analyzing computer code for malicious code, comprising:

• means for storing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods require use of different amounts of computer resources to analyze for malicious code;
• means for selecting a malicious code detection method requiring the use of the least amount of computer resources;
• means for analyzing computer code for malicious code using the selected malicious code detection method and outputting a result of the analysis;
• means for determining a probability of accuracy of the result of the analysis;
• means for selecting a malicious code detection method requiring the next least amount of computer resources and repeating the analyzing and determining, if the probability of accuracy is below a predetermined level;
• and
• outputting a result of the analysis if the probability of accuracy is at or above the predetermined level.

A storage medium including computer executable code for selecting a detection method for analyzing computer code for malicious code, the computer executable code comprising:

• code including a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods require use of different amounts of computer resources to analyze for malicious code;
• code for selecting a malicious code detection method requiring the use of a least amount of computer resources;
• code for analyzing computer code for malicious code using the selected malicious code detection method;
• code for determining a probability of accuracy of a result of the analysis;
• code for selecting a malicious code detection method requiring use of the next least amount of computer resources and repeating the analyzing and determining steps, if the probability of accuracy is below a predetermined level;
• and
• code for outputting a result of the analysis if the probability of accuracy is at or above the predetermined level.

A programmed computer system including computer executable code for selecting a detection method for analyzing computer code for malicious code, the system comprising:

• storage for storing a plurality of malicious code detection methods, wherein at least some of the malicious code detection methods require use of different amounts of computer resources to analyze for malicious code;
• a unit for reading and executing computer executable code, the computer executable code comprising,
• code for selecting a malicious code detection method requiring use of a lowest amount of computer resources,
• code for analyzing computer code for malicious code using the selected malicious code detection method,
• code for determining a probability of accuracy of a result of the analysis, and
• code for selecting a malicious code detection method requiring use of a next least amount of computer resources and repeating the analyzing and determining steps, if the probability of accuracy is below a predetermined level;
• and
• an output unit for outputting a result of the analysis if the probability of accuracy is at or above the predetermined level.