Patent ID: 8584241
Filing Date: 2013-11-12
Classification: G06F

Abstract:
1. A method for cleansing malicious data from a memory of a computer, the method comprising: in a first computer process, extracting attributes from a set of training data including benign, non-corrupted acceptable training data and/or malicious training data; in a second computer process, forming attribute vectors from the attributes extracted from the training data, wherein said attribute vectors comprise a data structure that represents at least: processes, execution paths, drivers, and kernel objects relating to the training data; in a third computer process, comparing attribute vectors formed from data of an unknown type contained in the memory with the attribute vectors formed from the training data to determine which ones of the attribute vectors formed from the data contained in the memory are similar or dissimilar to the attribute vectors formed from the training data, wherein the data of the unknown type is deemed malicious if its attribute vectors are similar to the attribute vectors of the malicious training data and wherein the data of the unknown type is deemed malicious if its attribute vectors are dissimilar to the attribute vectors of the benign, non-corrupted acceptable training data; removing from the memory of the computer the data of the unknown type deemed malicious.