Patent Document ID: 9386034
Application ID: 14151252
Patent Flag: 1

Claim One:
1. A method comprising: generating a behavioral model configured to describe one or more interactions associated with a protected data accessible by way of a computing device; determining an attempt to access the protected data is abnormal based, at least in part, on a comparison between the attempt to access the protected data and the behavioral model; determining the abnormal attempt to access the protected data is a malicious process based, at least in part, on a determined degree of variation from the behavioral model; generating a forensic image of one or more of the malicious process, one or more processes related to the malicious process, data associated with the malicious process, or data associated with the one or more processes related to the malicious process; causing, by a processor, the malicious process to be remediated with respect to the computing device; processing the forensic image to determine one or more indicators of compromise associated with the malicious process; causing, at least in part, the one or more indicators of compromise to be communicated to a malicious process remediation platform; and causing, at least in part, the malicious process remediation platform to initiate a proactive protection operation, the proactive protection operation comprising: sharing the one or more indicators of compromise with one or more other computing devices associated with the malicious process remediation platform; causing, at least in part, memory related to the one or more other computing devices to be scanned for the one or more indicators of compromise; determining the one or more indicators of compromise exist in the memory related to the one or more other computing devices, the one or more indicators of compromise indicating the malicious process is occurring or has occurred in the one or more other computing devices; and causing, at least in part, the malicious process to be remediated with respect to the one or more other computing devices, wherein the forensic image is generated during execution of the malicious process.