Patent ID: 11880452
Assignee: B QT TECHNOLOGIES
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 7:
8. A non-transitory computer readable storage medium storing instructions that when executed by one or more computer processors cause the one or more computer processors to perform steps comprising:
receiving a request for execution of an application on one or more computing systems;
generating a process graph for the application based on an execution of the application;
accessing a system profile map storing characteristics of applications known to be uncompromised;
comparing characteristics of the process graph of the application with characteristics of the process graph of a matching uncompromised application in the system profile map;
determining based on the comparison, that there are differences in the characteristics of the process graph of the application with characteristics of the process graph of a matching uncompromised application;
responsive to identifying differences in characteristics of the process graph of the application with characteristics of the process graph of a matching uncompromised application, identifying the application as a compromised application;
storing, by a learning unit, information describing the differences in characteristics of the process graph of the application with characteristics of the process graph of a matching uncompromised application; and
using the stored differences in characteristics for subsequently identifying compromised applications.