Patent ID: 7877806

Claim:
A method of detecting malicious software, wherein the method comprises: recording one or more previously intercepted activities in a list; intercepting a request to perform an activity in a processing system; determining an entity associated with the activity, wherein the entity comprises at least one of: a requesting entity of the activity; and a target entity of the activity; analysing the entity and the activity to determine if the entity and the activity are associated with malicious software, wherein the entity and the activity are analysed by: accessing one or more previously intercepted activities from the list, wherein a determination has not been made as to whether the previously intercepted activities are associated with malicious software; comparing the activity and the accessed one or more previously intercepted activities to a sequence of known malicious activities; in the event of a positive comparison, determining, in real time, that the entity and the activity are associated with malicious software; and in the event that the entity and the activity are determined to be associated with malicious software, restricting the request to perform the activity in the processing system.