Patent ID: 8595836

Claim:
A method for preventing malicious attacks on software that use a patching method, comprising the steps of: i) providing a first database of legitimate known patches, said first database containing characteristic signatures of said legitimate know patches; ii) providing a second database of malware in the form of malicious known patches, the second database containing characteristic signatures of said malware; iii) detecting whether an inspected patch within a running process is malicious by comparing the patch with a signature in said first database, and if a match is found, determining that said inspected patch is legitimate; iv) if a mismatch is found while comparing the patch with a signature is said first database, further comparing the patch with a signature in said second database, and if a match is found, determining that said inspected patch is malicious and performing one or more activities needed to prevent said malicious patch from performing undesired activities by making changes to said malicious patch or deleting said malicious patch; and v) if a mismatch is found while comparing the patch with a signature in said second database, determining that said inspected patch is unknown.