Patent ID: 11914710
Assignee: CAPITAL ONE SERVICES, LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G

Claim 7:
8. A computing apparatus comprising:
a processor; and
a memory storing instructions that, when executed by the processor, cause the processor to:
detect that a privilege level of a protected file of a set of protected files of a client device has been modified in response to successful access of the protected file using a high-level programming language access function;
maintain a record of protected files having modified privilege levels as an exposed file record;
monitor the exposed file record over time to detect a potentially hidden file, the potentially hidden file comprising a modified privilege level protected file that is hidden from the exposed file record;
determine that the potentially hidden file is a hidden file associated with malicious activity in response to successful access of the potentially hidden file using a lower level programming language access function; and
disable access for an application when the hidden file is detected.