Systems and methods for recognizing behavorial attributes of software in real-time

A computer-implemented method for recognizing behavioral attributes of software in real-time, comprising:

• receiving one or more recognizable patterns from a server, wherein the one or more patterns are associated with non-sequential runtime events and a set of inter-related dynamic characteristics of an executable file, the non-sequential runtime events and the set of inter-related dynamic characteristics being associated with a behavior of the executable file, and comprising a function call and abstract data types, the non-sequential runtime events of the executable file being translated from machine code to a high level language, the high level language comprising one or more labels written in human-readable text to describe the one or more traced non-sequential runtime events and the set of inter-related dynamic characteristics;
• executing an unidentified executable file;
• monitoring runtime events associated with the unidentified executable file;
• associating the monitored runtime events with a recognizable pattern received from the server;
• and
• identifying the unidentified executable file based on the recognizable pattern associated with the monitored runtime events, the recognizable pattern being based on the one or more labels.

A server system configured to recognize behavioral attributes of software in real-time, comprising:

• a processor;
• memory in electronic communication with the processor;
• the server configured to:
• execute an executable file;
• trace one or more non-sequential runtime events and a set of inter-related dynamic characteristics associated with the one or more non-sequential runtime events, the set of inter-related dynamic characteristics being associated with a behavior of the executable file, the one or more runtime events comprising a function call and abstract data types;
• translate the one or more non-sequential traced runtime events and the set of inter-related dynamic characteristics from machine code to a high level language, the high level language comprising one or more labels written in human-readable text to describe the one or more traced non-sequential runtime events and the set of inter-related dynamic characteristics;
• and
• produce a recognizable pattern of the translated traced non-sequential runtime events based at least in part on the set of inter-related dynamic characteristics, wherein the pattern comprises a unique behavioral set of the translated traced runtime events.