Patent ID: 8776236

Claim:
A method for providing storage device-based advanced persistent threat (APT) protection, the method being implemented by a computer including at least one processor, the method comprising: after receiving a file write request to write a file object to a persistent storage device, writing the file object to a temporary storage device; computing, using the at least one processor, a hash value of the file object in the temporary storage device; comparing, using the at least one processor, the hash value of the file object to a plurality of hash values stored in an APT database to determine if the hash value of the file object exists in the APT database, wherein the APT database stores the plurality of hash values of file objects that present an APT; if the hash value of the file object exists in the APT database, writing the file object to a quarantine storage location, and clearing the file object from the temporary storage device; and if the hash value of the file object does not exist in the APT database, executing an APT analysis on the file object to determine based on APT signature file object characteristics if the file object presents an APT.