Patent ID: 9483642
Filing Date: 2016-11-01
CPC Classification: G06F

Claim Text:
1. A method for detecting malicious active processes and self-replicating executable binary files on a computing device in runtime, the method comprising: monitoring in runtime and in user mode at least one of a file creation event and a file modification event on a computing device; monitoring in runtime and in user mode a plurality of active processes running on a-said computing device to detect a new process creation event; extracting at least one unique identifier of each active process of said plurality of active processes which maps said active process to at least one executable binary file containing executable code of said active process; monitoring in runtime and in user mode at least one of creation and modification event of a plurality of files hosted by said computing device having an indication of a link to said detected new process creation event; identifying at runtime and in user mode a plurality of executable binary files among said plurality of files; monitoring at runtime and in user mode concurrent operation of a plurality of logical sensors which detect malicious behavioral patterns of said plurality of active processes and maintain at least one list of malicious behavioral pattern findings; identifying at runtime and in user mode at least one match between said at least one unique identifier of each active process and at least one of said plurality of executable binary files; and detecting at runtime and in user mode at least one suspected malicious active process of a suspected malware from said plurality of active processes and a corresponding at least one self-replicating executable binary file of said plurality of executable binary files according to said at least one match and said malicious behavioral pattern findings, wherein maintaining a binary files list of said plurality of executable binary files and an active processes list of records each of at least one unique identifier of each active process, and wherein said detecting at least one malicious active process comprises comparing records in said binary files list and said active processes list, wherein identifying a plurality of cloned files among said plurality of executable binary files; monitoring in runtime creation of at least one new process running on a computing device; extracting at least one unique identifier of said at least one new active process which maps said new active process to at least one executable binary file containing executable code of said new active process; and identifying said new active process as a cloned process according to a match between respective said at least one unique identifier of each active process and at least one of said plurality of cloned files.