Malware detectors require a specification of malicious behavior. Typically, these specifications are manually constructed by investigating known malware. Our technique derives such a specification by comparing the execution behavior of a known malware against the execution behaviors of a set of benign programs.