Patent ID: 9323928
Filing Date: 2016-04-26
CPC Classification: G06F,G16B,H04L

Claim Text:
1. At least one non-transitory machine readable storage medium, having instructions stored thereon, the instructions when executed on a machine, cause the machine to: collect a plurality of features of each of a plurality of processes; apply a plurality of classification rules to the plurality of features, wherein each of the plurality of classification rules corresponds to one or more of a plurality of process categories, and each of the plurality of classification rules comprises a logical combination of a set of the plurality of features; apply a plurality of weights to the plurality of classification rules to produce a plurality of weighted threat scores, wherein: compare the plurality of weighted threat scores to a plurality of threshold values, wherein each of the plurality of threshold values corresponds to one of the plurality of process categories; and classify the process in the one or more process categories based at least on the comparison of the plurality of weighted threat scores to the plurality of predetermined thresholds.