Patent ID: 9372989
Filing Date: 2016-06-21
CPC Classification: G06F

Claim Text:
1. A malware detection and diffusion system comprising: at least one server side computer; and at least one client side computer; wherein: at least one malware sample is processed in at least one server side computer by intercepting all of the malware's system calls in kernel mode; at least one signature is formed for each malware sample by a server side computer having at least one stop call at or prior to a fixing moment; the signature is distributed by the server side computer to at least one client side computer, wherein: a driver hooks all of the system calls at the kernel level of the operating system of the client side computer in real time, without use of emulation; the systems calls are processed by a filter to remove trusted system calls; the system calls not removed by the filter are accumulated on a per-thread basis and checked for a stop call; a detector compares the thread associated with the stop call to the signature for a match with malware prior to the fixing moment; and the thread that is matched with malware is addressed at the fixing moment.