Patent ID: 9734337
Date: 2017-08-15
CPC Classifications: G06F

Claim:
1. A method for detecting and removing malware, the method comprising: monitoring a target thread executing on a computing device; storing to a log in a storage device, a parent reference to a parent thread that launched the target thread or injected code into the target thread; detecting, by a processor, a behavior of the target thread that conforms to one of a predefined set of behaviors indicative of ransomware; responsive to detecting the behavior, storing a new indicator associated with the detected behavior to the log, the log storing a plurality of past indicators for respective previously detected behaviors of the target thread, and the log storing respective scores for the new indicator and the plurality of past indicators; generating a running score for the target thread by combining the respective scores of the plurality of past indicators and the new indicator associated with the target thread in the log; determining that the running score for the target thread exceeds a predefined threshold score; responsive to determining that the running score exceeds the predefined threshold score, terminating execution of the target thread; identifying the parent thread based on the parent reference in the log and terminating execution of the parent thread; identifying based on a source file reference stored in the log in association with the parent thread, a source malware file that launched the parent thread; and responsive to identifying the source malware file that launched the parent thread, quarantining the source malware file.