Patent ID: 9378369
Filing Date: 2016-06-28
CPC Classification: G06F

Claim Text:
1. A method of detecting file modifications performed by malicious code, the method to be performed by a computer and comprising: detecting a file modification for an original file in a file system before the file modification is performed on the original file in the file system; in response to detecting the file modification, creating a shadow file of the original file before the file modification is performed on the original file in the file system, the shadow file representing the original file as modified with the file modification and how the original file will be if the file modification is allowed to be performed on the original file; before allowing the file modification to be performed on the original file in the file system, comparing the original file to the shadow file to find a difference between the original file and the shadow file, and determining if the file modification is being performed by the malicious code based on the difference; deeming the file modification to be performed by the malicious code when the shadow file includes inconsistent data not present in the original file; and preventing the file modification from being committed to the file system when the file modification is deemed to be performed by the malicious code.