Patent ID: 11886585
Assignee: MUSARUBRA US LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 9:
10. A non-transitory storage medium including code including a first logic unit to operate in a kernel space of a memory and a second logic unit configured to operate in a user space of the memory that, upon execution by one or more processors, performs operations comprising:
receiving, by the first logic unit via an Application Programming Interface, a notification identifying a newly created thread;
determining a thread type associated with the newly created thread to determine whether the newly created thread is a predetermined thread type;
extracting, by the first logic unit operating within the kernel space, at least meta-information associated with the newly created thread included as part of the notification when the newly created thread is a thread type other than the predetermined thread type;
receiving, by the second logic unit, at least the meta-information associated with the newly created thread;
conducting, by the second logic unit, analytics on at least the meta-information to attempt to classify the newly created thread; and
issuing an alert, as generated by the second logic unit, upon classifying the newly created thread as a cyberattack associated with a malicious position independent code execution based at least on results of the analytics associated with the meta-information associated with the newly created thread.