Patent ID: 9104864
Filing Date: 2015-08-11
Classification: G06F,H04L

Abstract:
1. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, performs the steps of: providing a first database that correlates a plurality of threat characteristics to a threat, wherein a presence of the plurality of the threat characteristics confirms a presence of the threat; detecting a change event in a computer run-time process; testing the change event for a presence of one or more of the plurality of threat characteristics upon detection of the change event; storing a detection of one of the plurality of threat characteristics in a second database that accumulates detected characteristics for the computer run-time process; scaling the plurality of threat characteristics in the first database to a number of relevant threat characteristics based upon accumulated detected characteristics in the second database using an inverted threat index that associates each of a number of particular characteristics with one or more particular threats, and for each one of the one or more particular threats, further specifies how many particular characteristics are used to identify the one of the one or more particular threats, thereby updating the first database as threat characteristics are detected in change events; and identifying the threat when the number of relevant threat characteristics appear in the second database.