Patent ID: 11914711
Assignee: VERSA NETWORKS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 13:
14. A non-transitory computer readable medium storing computer readable instructions, that when executed on one or more processors, implements a method comprising:
running a virtual machine with an operating system configured with a monitoring subsystem, the monitoring subsystem configured to generate event data based on a plurality of events occurring on the virtual machine;
running a classifier configured to detect a malware based on the plurality of events;
running a sample on the virtual machine, the classifier detecting the malware in the sample; and
running a countermeasure compiler that generates a countermeasure to the malware, the countermeasure based on the event data,
wherein the countermeasure includes at least one executable instruction,
wherein executing the at least one executable instruction on a computer inoculates the computer from infection by the malware,
wherein the monitoring subsystem is configured to:
run within a kernel of the operating system,
monitor a first process not associated with the sample,
monitor a second process,
monitor a tripwire file, and
monitor a system file; and

wherein the classifier is configured to:
detect the malware based on the sample modifying the tripwire file,
detect the malware based on the sample modifying the system file,
detect the malware based on the sample terminating the first process,
detect the malware based on a type of access to the second process requested by the sample, and
detect the malware based on an identity of the second process accessed by the sample.