Patent ID: 8196201

Claim:
A computer-implemented method to detect malicious activity, wherein the method comprises: transmitting filter feedback data to a server processing system, the filter feedback data indicative of a frequency that one or more filter rules have previously been satisfied, wherein the one or more filter rules comprise information identifying one or more requesting entities and one or more target entities; receiving, from the server processing system, order data, the order data indicative of an order of the filter rules in a list of filter rules, wherein an overall frequency is calculated for a filter rule, wherein a weight factor is applied to calculate the overall frequency for the filter rule, wherein the weight factor is based on how recently the filter rule was satisfied; intercepting, by a hardware processor, an activity in a processing system, wherein a requesting entity requests the activity to be performed in relation to a target entity; determining the identity of the requesting entity that requests the activity and the identity of the target entity; determining, using a filter module, if the activity is suspicious or non-suspicious by comparing at least the identity of the requesting entity and the identity of the target entity with the information within the filter rules that identifies the one or more requesting entities and the one or more target entities, wherein the filter module comprises the list of filter rules; and in response to determining that the activity is suspicious, analyzing, by the processor, the activity, the requesting entity and the target entity using an analysis module to detect malicious activity.