Patent ID: 8813227

Claim:
A method for securing an electronic device, comprising: trapping, at a level below all of operating systems of the electronic device accessing a memory, attempted accesses to the memory, wherein each of such attempted accesses, individually or in aggregate, indicates a presence of self-modifying malware; in response to trapping each attempted access to memory, recording information associated with the attempted access in a history; and in response to a triggering attempted access associated with a particular memory location, analyzing information in the history associated with the particular memory location to determine if suspicious behavior has occurred with respect to the particular memory location, wherein analyzing information in the history comprises: determining that suspicious behavior has occurred if information in the history indicates that the content at a first memory location was copied to a second location, modified at the second location, and then an attempted execution of the content of the second location has occurred; determining that suspicious behavior has occurred if information in the history indicates that the content at a third memory location and a fourth memory location each having a common ancestor at a fifth location have each been the target of an attempted execution; and determining that suspicious behavior has occurred if information in the history indicates that the content at a particular memory location has ancestors at a plurality of other memory locations; initiating corrective action in response to determining that suspicious behavior has occurred with respect to the particular memory location; determining whether the particular memory location has been affected by malware; and initiating further corrective action in response to determining that the memory location has been affected by malware, wherein initiating further corrective action comprises at least one of: disallowing execution of content associated with the memory location, reversing changes to the content set forth in the history, repairing the content, replacing the content with harmless content, and disabling a process associated with the content.