Patent Document ID: 20170046512
Application ID: 15338399
Patent Flag: 0

Claim One:
1. A method for detecting malicious active processes and self-replicating executable binary files on a computing device in runtime, the method comprising: executing a code on at least one hardware processor for: monitoring at least one of a file creation event and a file modification event held by an operating system executed in a user mode on said at least one hardware processor to detect a plurality of executable binary files; monitoring new process creation events of a plurality of active processes executed by said operating system on said at least one hardware processor; detecting at least one match between one of said plurality of active processes and one of said plurality of executable binary files; detecting at least one self replication event of said plurality of executable binary files according to an analysis of said at least one match; and suspending or terminating at least one of said plurality of active processes based on a comparison between said at least one self replication event and at least one known suspicious pattern.