A method for automated neutralizing of fileless malware on connected loT devices, comprising: a) by a Feature Extractor module, receiving and collecting data regarding operation software of one of the loT devices from the device's memory, commands from the device's processor and data from the device's network card; b) analyzing the collected data and extracting the device's behavioral pattern by said Feature Extractor module; c) examining said behavioral pattern of the device received and deciding whether there was a malware break/attack or there is a malfunction of the device itself, and using an anomaly detection algorithm that inspects an internet connection and flags suspicious behavior as intrusions; d) in case that there is a malware attack in the device, sending remediation, repairing and neutralization commands; e) by a Normal Behavior Assessment module, assessing whether the device's behavior and operation are normal or abnormal, using a machine learning model, and concluding that the device is not under malware attack anymore if the behavior and operation of the device are found normal and that the device is still under malware attack if the behavior and operation of the device are not normal; and f) sending a command by said Normal Behavior Assessment module to change the remediation and neutralization actions following the conclusion that the device is still under malware attack, characterized in that said extracted behavioral pattern is sent to an Intrusion Detector which comprises a plurality of distributed intrusion detector components, wherein one or more of said distributed intrusion detector components receives said behavioral pattern extracted from said Feature Extractor, examines said received behavioral pattern, decides whether there was a malware break/attack or there is a malfunction of the device itself by learning from all the devices in the network by means of a network communication module, and sends the decision regarding occurrence of the malware attack and type of malware attack from said Intrusion Detector to a Remediation Selector, wherein said Remediation Selector comprises a collaborative evolutionary learning-based software module and a plurality of distributed remediation selector components, wherein one or more of said distributed remediation selector components are capable of learning in real-time from all devices in the network by means of the network communication module how different pre-defined actions affect said plurality of devices, receive from said Intrusion Detector a decision if the device is under a malware attack and its kind, and send the remediation, repair and neutralization commands to an LSTM Neural Network, wherein the command to change the remediation and neutralization actions is sent from said Normal Behavior Assessment module to said Remediation Selector. a) by a Feature Extractor module, receiving and collecting data regarding operation software of one of the loT devices from the device's memory, commands from the device's processor and data from the device's network card; b) analyzing the collected data and extracting the device's behavioral pattern by said Feature Extractor module; c) examining said behavioral pattern of the device received and deciding whether there was a malware break/attack or there is a malfunction of the device itself, and using an anomaly detection algorithm that inspects an internet connection and flags suspicious behavior as intrusions; d) in case that there is a malware attack in the device, sending remediation, repairing and neutralization commands; e) by a Normal Behavior Assessment module, assessing whether the device's behavior and operation are normal or abnormal, using a machine learning model, and concluding that the device is not under malware attack anymore if the behavior and operation of the device are found normal and that the device is still under malware attack if the behavior and operation of the device are not normal; and f) sending a command by said Normal Behavior Assessment module to change the remediation and neutralization actions following the conclusion that the device is still under malware attack, characterized in that said extracted behavioral pattern is sent to an Intrusion Detector which comprises a plurality of distributed intrusion detector components, wherein one or more of said distributed intrusion detector components receives said behavioral pattern extracted from said Feature Extractor, examines said received behavioral pattern, decides whether there was a malware break/attack or there is a malfunction of the device itself by learning from all the devices in the network by means of a network communication module, and sends the decision regarding occurrence of the malware attack and type of malware attack from said Intrusion Detector to a Remediation Selector, wherein said Remediation Selector comprises a collaborative evolutionary learning-based software module and a plurality of distributed remediation selector components, wherein one or more of said distributed remediation selector components are capable of learning in real-time from all devices in the network by means of the network communication module how different pre-defined actions affect said plurality of devices, receive from said Intrusion Detector a decision if the device is under a malware attack and its kind, and send the remediation, repair and neutralization commands to an LSTM Neural Network, wherein the command to change the remediation and neutralization actions is sent from said Normal Behavior Assessment module to said Remediation Selector.