Patent ID: 8474039

Claim:
A method for detecting malware memory infections, comprising the steps of: scanning a memory on an electronic device, the memory comprising memory vulnerable to memory modifications caused by malware; determining a suspicious entry present in the memory, the suspicious entry not recognized as a safe entry, the suspicious entry comprising a modification to an existing entry in memory; accessing information about the suspicious entry from a reputation system, the reputation system configured to store information on suspicious entries; and evaluating whether the suspicious entry indicates a malware memory infection, wherein the evaluation is based upon historical data regarding the suspicious entry, comprising: comparing the distribution pattern of the suspicious entry against a known distribution pattern, the known distribution pattern indicating a safe memory modification or indicating a malware memory infection; comparing a determined quantity of devices for which the suspicious entry has been reported against an upper threshold; comparing the time range of the determined quantity of devices against a lower threshold; and determining that the suspicious entry does not indicate a malware memory infection if the determined quantity of devices exceeds the upper threshold and the time range of the determined quantity of devices is less than the lower threshold.