Patent ID: 11882134
Assignee: VMWARE LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  B  G | IPC B  G  H

Claim 7:
8. A system for generating a stateful rule for behavior based threat detection, the system comprising:
a processor; and
a non-transitory computer readable medium having stored thereon program code, the program code causing the processor to:
identify a new threat in a first run of an attack on an endpoint node;
upon identifying the new threat, import a primitive rule;
compile the primitive rule;
deploy the compiled primitive rule on the endpoint node;
generate, using the deployed primitive rule, additional information about the new threat in a second run of the attack;
based on the additional information about the new threat, generate a new rule;
compile the new rule;
deploy the compiled new rule on the endpoint node; and
block, using the deployed new rule, the new threat in a third run of the attack.