Method and system for identifying malware through differences between cloud vs. client behavior

摘要

Computing devices may be configured to work with other components (e.g., servers) to better determine whether the software application is benign or irrational.This means that the server executes a static and / or dynamic analysis operation to describe or characterize the correct or expected behavior range of the software application, or generate a behavioral information structure, and compute the behavior information structure Can be achieved via sending to a device.The computing device compares the received behavior information structure with the locally generated behavior information structure, and the observed behavior of the software application is different from the expected behavior of the software application Or whether or not the observed behavior is within the expected behavior is determined.The computing device can increase the level of security / scrutiny when the behavioral information structure does not match the local behavior information structure.