Patent Document ID: 20140123280
Application ID: 13663610
Patent Flag: 0

Claim One:
1. A method for detecting malicious active processes and self-replicating executable binary files on a computing device in runtime, the method comprising: monitoring in runtime a plurality of active processes running on a computing device; extracting at least one unique identifier of each active process of said plurality of active processes which maps said active process to at least one executable binary file containing executable code of said active process; monitoring in runtime creation and modification of a plurality of files hosted by said computing device; identifying a plurality of executable binary files among said plurality of files; monitoring concurrent operation of a plurality of logical sensors which detect malicious behavioral patterns of said plurality of active processes and maintain at least one list of malicious behavioral pattern findings; and detecting at least one suspected malicious active process of a suspected malware from said plurality of active processes and a corresponding at least one self-replicating executable binary file of said plurality of executable binary files according to at least one match between respective said at least one unique identifier, said malicious behavioral pattern findings, and at least one of said plurality of executable binary files.