Carbon Black, Inc.

Accessdata Group, LLC

Andrew Ruef

Allen Saunders

Benjamin Johnson

Jason James McFarland

Michael Viscuso

A security client can be configured to operate on the one or more computing systems and record all events occurring on the one or more computing systems. The security client can operate as a 'security camera' for the computing systems by identifying and retaining data and information that describes and details different events that occur on the computing systems. The security client can be configured to generate event records for the events that are uniquely associated with the process that requested or performed event. Likewise, the security client can be configured to uniquely associate the event records with the specific computing system associated with the event.

Systems and methods for tracking and recording events in a network of computing systems

The present invention extends to methods, systems, and computer program products for identifying software execution behavior. Embodiments of the invention can be used to assist a user in a making a reasoned and informed decision about whether the behavior of executable code is malicious. Data indicative of executable code behavior can be collected statically without having to execute the executable code. Behavior data can be collected essentially automatically with little, if any, user involvement. A user initiates analysis of executable code and is provided a visual categorized representation of behavior data for the executable code.

Growing community of inventors

Columbia, MD, United States of America

Andrew Ruef