Patent ID: 11876815
Assignee: MCAFEE, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A method of detecting latent malware behavior in a computing device, comprising:
receiving an assignment of the computing device as belonging to one or more classes;
receiving, from a cloud service, respective class-specific global trend lines for the one or more classes, wherein the class-specific global trend lines include data on global device usage of compute resources for the one or more classes;
computing historical device-specific class-specific historical local trend lines for the one or more classes, wherein the local trend lines are based on local usage of the compute resources by the computing device and include a difference between local usage and global usage;
computing a local recent short-term trend line for a class;
detecting an anomaly based on detecting that the local recent short-term trend line deviates statistically significantly from its historical local trend line; and
based on detecting the anomaly, notifying a user of the computing device, or a security administrator, of the anomaly, including a time of the anomaly and which device use parameters experienced the anomaly.