Patent ID: 8490195

Claim:
A computer implemented method of detecting malware on a computer, comprising: detecting, using at least one computer processor, a request by a process executing on the computer to change time of a clock managed by the computer; identifying the process as a potential threat; receiving, over a network, at least one first attribute associated with the process; analyzing the at least one first attribute associated with the process to determine a threat level, wherein the at least one first attribute comprises an attribute indicating a trustworthiness of the process; analyzing at least one second attribute associated with the process to determine a threat level, wherein the at least one second attribute comprises at least one operating system attribute indicative of interaction between the process and an operating system executing on the computer, and wherein the at least one operating system attribute comprises an indication of whether the process is executing in a visible window of the operating system; and blocking the request to change the time of the clock and designating the process as a true positive threat if the threat level satisfies a threshold level, wherein blocking the request to change the time of the clock prevents a change in time of the clock managed by the computer.