US Patent 11048799 Dynamic malware analysis based on shared library call information

A non-transitory computer-readable storage medium storing a program that causes an information processing apparatus to execute a process, the process includes executing a first program by using a system including a kernel of an operating system (OS) and shared libraries, acquiring first information on a first file group read out from the shared libraries, executing a second program by using the system, acquiring second information on a second file group read out from the shared libraries, executing similarity determination processing of determining similarity between the first program and the second program by comparing the first information and the second information that have been acquired, and outputting the similarity that has been determined.