Malicious behavior of a computer program is detected using an emulation engine, an event detector and an event analyzer. The emulation engine includes a system emulator configured to emulate, in an isolated computer environment, at least a part of a computer system and a program emulator configured to...http://www.google.com.au/patents/US7614084?utm_source=gb-gplus-sharePatent US7614084 - System and method for detecting multi-component malware
