Patent ID: 11868479
Assignee: ARIZONA BOARD OF REGENTS ON BEHALF OF THE UNIVERSITY OF ARIZONA
Field: Medical technology (Instruments)
Classification: CPC G  H  A | IPC A  G

Claim 14:
15. A method for detecting malware in a device able to be connected to a network or external computer system, said method comprising the steps of:
modeling normal system behavior of the device;
comparing current system operation of the device to the modeled normal system behavior;
estimating a probability of the current system operation of the device being affected by malware based on performance deviation between the current system operation and the modeled normal system behavior; and
performing a static risk evaluation and, during operation of the device, a dynamic risk evaluation, and determining a calculated risk threshold, estimated probabilities, or both, based on said evaluations, wherein performing a static risk evaluation comprises assigning calculated security-health and security-data-sensitivity scores to tasks performed by each operational mode of the device, calculating a task risk score for each of said tasks, and establishing static risk thresholds for each operation mode based on accumulated task risk scores.