Determining whether process is infected with malware

A method of detecting malware by a computer system comprising:

• obtaining information relating to executable regions of a process extracted from system memory, the information extracted from the system memory including a process list of a plurality of processes running in a user space in the system memory, and a module list of executables associated with the plurality of processes running in the user space;
• finding a process model which matches the extracted process, the process model representing a clean version of the process and including identifiers of executables and probabilities of occurrence of the executables in the clean version of the process, wherein information relating to executable regions in the process model include statistical information on probabilities of occurrence of a plurality of structural features in the clean version of the process;
• matching the executable regions of the extracted process, using the information extracted from the system memory, with the executables in the process model based on the identifiers;
• calculating a degree of similarity utilizing a hash of the process and a hash of the process model and determining if the calculated degree of similarity satisfies a predetermined threshold condition;
• and
• making a determination whether the process is infected with malware based on whether the executable regions in the process match executables in the process model and the probabilities of occurrence of the executables in the process model, wherein the determination whether the process is infected with malware is based on at least one of the following:
• presence of executable regions in the extracted process which do not match with executables in the process model, presence of executable regions in the process which match executables having a low probability of occurrence in the process model, wherein the low probability of occurrence comprises a probability below a first predetermined threshold, or executables which have a high probability of occurrence in the process model not being matched with any executable regions of the process;
• wherein the high probability of occurrence comprises a probability above a second predetermined threshold.

A non-transitory computer readable storage medium storing instructions executable by a processor to:

• obtain structural information of a process extracted from a snapshot of system memory, the snapshot of system memory including a process list of a plurality of processes running in a user space in the system memory, and a module list of executables associated with the plurality of processes running in the user space;
• make a comparison of the structural information of the extracted process extracted from the snapshot of system memory with structural information of a clean process model representing a clean version of the process and an infected process model representing an infected version of the process, wherein the structural information of the clean process model includes statistical information on probabilities of occurrence of a plurality of structural features in the clean version of the process, and wherein the instructions to make a comparison of the structural information comprises instructions to:
• calculate a degree of similarity utilizing a hash of the process and a hash of the clean process model;
• and
• determine if the calculated degree of similarity satisfies a predetermined threshold condition;
• and
• determine whether the process is infected with malware based on the comparison, wherein the instructions to determine whether the process is infected with malware comprises instructions to make a determination based on whether structural features of the extracted process are matched with structural features in the clean process model or the infected process model, and respective probabilities of occurrence of the matched structural features in the clean process model and the infected process model.