A method for protecting a secured device from access via hacking, the method comprising the step of installing on the secured device an application executable on a non-transitory computer-readable medium of the secured device; said secured device with said application effecting further steps of the method comprising the steps of: a. receiving one or more system calls and one or more network calls of said secured device, by a timestamp module; b. timestamping said system calls and said network calls by said timestamp module; c. packaging said timestamped system calls and timestamped network calls, by a correlation module, into an input vector; and d. receiving, by said correlation module, one or more lists of privileges for one or more applications installed on said secured device; wherein the method further comprises the steps: e. computing parameters of said system calls and said network calls, said parameters selected from a group comprising a difference in time values of said timestamp of a said system call and a said network call, a correspondence of a said system call or of a said network call with a privilege in one or more of said lists pertaining to an application making said system call or said network call, a validity of a certificate attached to said network call, or any combination thereof; f. further packaging said parameters into said input vector; g. receiving said input vector by a neural network; h. determination, by said neural network, of whether a said system call or a said network call is approved or suspected; i. feeding a said approved system or network call to an approved output and a suspected system or network call to a suspected output; j. receiving, by a mitigation rules engine, said suspected output; k. determining, by said mitigation rules engine, a mitigating action as a function of said suspected output. a. receiving one or more system calls and one or more network calls of said secured device, by a timestamp module; b. timestamping said system calls and said network calls by said timestamp module; c. packaging said timestamped system calls and timestamped network calls, by a correlation module, into an input vector; and d. receiving, by said correlation module, one or more lists of privileges for one or more applications installed on said secured device; e. computing parameters of said system calls and said network calls, said parameters selected from a group comprising a difference in time values of said timestamp of a said system call and a said network call, a correspondence of a said system call or of a said network call with a privilege in one or more of said lists pertaining to an application making said system call or said network call, a validity of a certificate attached to said network call, or any combination thereof; f. further packaging said parameters into said input vector; g. receiving said input vector by a neural network; h. determination, by said neural network, of whether a said system call or a said network call is approved or suspected; i. feeding a said approved system or network call to an approved output and a suspected system or network call to a suspected output; j. receiving, by a mitigation rules engine, said suspected output; k. determining, by said mitigation rules engine, a mitigating action as a function of said suspected output.