Palo Alto Networks, Inc.
Context-based analysis of applications

Abstract:

Evaluating samples is disclosed. A sample is received. A system component dependency graph is built for the sample. In particular: (1) a dependency relation between at least one system event and at least one system component is analyzed; (2) dependency relations between a plurality of system components are analyzed; and (3) a dependency relation between at least one system component and at least one indirect call component is analyzed. A verdict for the sample is determined based at least in part on the system component dependency graph.