Patent ID: 8176555
Filing Date: 2012-05-08
Classification: G06F

Abstract:
1. A computer-implemented method for detecting malicious processes based at least in part on an analysis of process names, the method comprising: identifying a process; identifying a process name for the process; identifying a list of known non-malicious processes, wherein the list of known non-malicious processes identifies, for each non-malicious process within the list, at least one of: determining, at least in part by comparing the process name for the process with the list of known non-malicious processes, that the process represents an attempt to mimic a process name of at least one known non-malicious process; determining, based on the determination that the process represents an attempt to mimic the process name of at least one known non-malicious process, that the process represents a security risk; preventing the process from executing; wherein at least a portion of the method is performed by a computing device comprising at least one processor.