/Patent Tracker
GooglePatent applicationSecurity & privacyInterest 6/10

Google patents malware detection by tweaking code branches

Google describes a method for spotting malware by slightly changing how a program's decision-making instructions work. The system runs this altered code in a safe test area to see if it behaves differently than the original, which can reveal hidden malicious actions. If the behavior changes in a way that suggests danger, the system triggers protective measures.

Why it mattersThis approach helps security teams uncover hidden threats that might act normally during standard scans but reveal their true intent when their code logic is slightly disturbed.

In the filing’s own words

A method includes identifying executable code that includes branch instructions, modifying one or more of the branch instructions of the executable code, causing execution of the executable code with the modified branch instructions in a testing environment, evaluating a result of the execution of the executable code with the modified branch instructions, determining, based on the evaluating, that the execution of the executable code with the modified branch instructions in the testing environment reveals functionality of the executable code that differs from functionality of the executable code executed without the modified branch instructions, and causing one or more preventative actions to be performed with respect to the executable code.

What exactly they claim (claim 1)

1. A method, comprising: identifying, by at least one processing device, executable code comprising branch instructions; modifying, by the at least one processing device, first one or more of the branch instructions of the executable code to alter execution behavior of the executable code; causing, by the at least one processing device, execution of the executable code with the modified first one or more branch instructions in a first testing environment; and evaluating, by the at least one processing device, a result of the execution of the executable code with the modified first one or more branch instructions; determining, based on the evaluating, that the execution of the executable code with the modified first one or more branch instructions in the first testing environment reveals functionality of the executable code that differs from functionality of the executable code executed without the modified first one or more branch instructions, the revealed functionality indicating maliciousness of the executable code; and causing, by the at least one processing device, one or more preventative actions to be performed with respect to the executable code.

Facts

Company
Google (Google LLC)
Official title
DETECTING MALWARE BY MODIFYING EXECUTABLE CODE
Publication number
US20260278094A1
Application number
19680984
Filed
May 18, 2026
Published
Sep 17, 2026
Inventors
1
Claims
20

Classified under

G06F 21/563 Physics & computing
Read the full filing (official PDF) ↗ Open in the Patent Tracker

More from Google in Security & privacy

Summaries are simplified from the filing’s own abstract and first claim. A patent filing is not a product announcement.
Patent data and drawings: U.S. Patent and Trademark Office (USPTO). Nebula is not affiliated with or endorsed by the USPTO.