Patent Document ID: 10152598
Application ID: 15628930
Patent Flag: 1

Claim One:
1. A computer-implemented method comprising: receiving, from a computing device, data indicating a configuration of the computing device and data indicating one or more computing resources of the computing device that the computing device allocated to a process upon execution of the process; based on the configuration of the computing device and on the one or more computing resources that the computing device allocated to the process upon execution of the process, determining one or more other computing resources that the computing device has available for allocation upon execution of the process; determining a ratio of the one or more other computing resources that the computing device has available for allocation upon execution of the process to the one or more computing resources that the computing device allocated to the process upon execution of the process; based on the ratio of the one or more other computing resources that the computing device has available for allocation upon execution of the process to the one or more computing resources that the computing device allocated to the process upon execution of the process, determining a risk score (i) that reflects a greater likelihood that the process is a malicious process as the ratio of the one or more other computing resources that the computing device has available for allocation upon execution of the process to the one or more computing resources that the computing device allocated to the process upon execution of the process decreases and (ii) that reflects a lesser likelihood that the process is a malicious process as the relative portion of the one or more other computing resources that the computing device has available for allocation upon execution of the process to the one or more computing resources that the computing device allocated to the process upon execution of the process increases; and based on the risk score (i) that reflects a greater likelihood that the process is a malicious process as the ratio of the one or more other computing resources that the computing device has available for allocation upon execution of the process to the one or more computing resources that the computing device allocated to the process upon execution of the process decreases and (ii) that reflects a lesser likelihood that the process is a malicious process as the relative portion of the one or more other computing resources that the computing device has available for allocation upon execution of the process to the one or more computing resources that the computing device allocated to the process upon execution of the process increases, determining whether to add the process to a blacklist or a whitelist.