Multi-Component Malware Detection via Event Aggregation

The patent merges the analysis of multiple executable components by collecting events from all components and analyzing them collectively. The event analyzer aggregates events from the main program and all child processes, then compares the combined event sequence against malware patterns, enabling detection of distributed malicious behavior that individual component analysis would miss.

The patent transitions from analyzing components in isolation (one-dimensional) to analyzing the temporal sequence of events across all components (multi-dimensional). By examining the ordered sequence of events and their temporal relationships across multiple processes, the system detects malicious patterns that span across component boundaries.

The patent segments the malware detection task into distinct phases: event collection from individual components, event sequencing and correlation, and pattern matching against known malware behaviors. The event analyzer processes events in a structured sequence, comparing aggregated events against predefined malware patterns, which reduces the complexity of analyzing the totality of events.

The event analyzer serves as an intermediary that aggregates events from multiple executable components and transforms them into a unified event sequence for pattern matching. This intermediary layer simplifies the complexity by providing a standardized interface between diverse component events and the malware detection logic.

The patent performs preliminary actions by pre-defining malware event patterns and criteria before execution analysis. The system prepares the detection framework in advance with known malware signatures and behavioral patterns, enabling faster real-time comparison during actual malware detection without requiring complex analysis of all possible event combinations.

The event analyzer skips through the aggregated event sequence efficiently by comparing against predefined malware patterns. Rather than performing exhaustive analysis of all event combinations, the system rapidly processes the event sequence by matching against known malicious patterns, reducing processing time while maintaining detection capability.