Patent ID: 9710648
Date: 2017-07-18
CPC Classifications: G06F

Claim:
1. A computer-implemented method of detecting malware in real time in a live environment, the method implemented on a computer that performs each step of the method, the method comprising: monitoring one or more operations of at least one program concurrently running in the live environment, wherein the step of monitoring further comprises: operation type, and source of the event; building at least one stateful model in accordance with the one or more operations, wherein the stateful model is a data structure representing information indicative of a real time updated system state resulting from a sequence of linked operations performed in the live environment, wherein the step of building the at least one stateful model comprises: for each said event data: thereby giving rise to an updated stateful model representing a hierarchical structure comprising the entities involved in said linked operations and interconnections between the entities which are resulted from the linked operations; analyzing the at least one stateful model to identify one or more behaviors, wherein the step of analyzing the at least one stateful model comprises: determining the presence of malware based on the identified one or more behaviors.