Threat detection system

A computer system comprising:

• a memory configured to store computer program code, and
• a processor configured to read and execute computer program code stored in the memory,
• wherein the processor is configured to cause the computer system to perform:
• a) analysing the computer system to find any at least one of applications or services exhibiting common at least one of vulnerability types or misconfigurations known to exist;
• b) monitoring installation and normal operation of such found at least one of applications or services of the analysed computer system that are detected to exhibit said common at least one of vulnerability types or misconfigurations;
• c) creating and storing representations of expected behaviors of the monitored at least one of applications or services on the basis of the monitoring, comprising maintaining a respective behavior profile for each respective monitored at least one of applications or services, wherein the respective behavior profile identifies, for one or more procedures of the respective monitored at least one of applications or services, a respective characteristic action and respective one or more expected actions for each of the monitored at least one of applications or services;
• d) monitoring the behavior of the computer system to detect the one or more procedures of the monitored at least one of applications or services that do not match the expected behaviors of the respective monitored at least one of applications or services defined in the respective behavior profile;
• and upon detection of the one or more procedures not matching the expected behaviors of the monitored at least one of applications or services, identifying said at least one of applications or services as malicious or suspicious.

A non-transitory computer storage medium of a computer system having stored thereon computer program code for implementing

• a) analysing the computer system to find any at least one of applications or services exhibiting common at least one of vulnerability types or misconfigurations known to exist;
• b) monitoring installation and normal operation of such found at least one of applications or services of the analysed computer system that are detected to exhibit said at least one of vulnerability types or misconfigurations;
• c) creating and storing representations of expected behaviors of monitored at least one of applications or services on the basis of the monitoring, comprising maintaining a respective behavior profile for each respective monitored at least one of applications or services, wherein the respective behavior profile identifies, for one or more procedures of the respective monitored at least one of applications or services, a respective characteristic action and respective one or more expected actions for each of the respective monitored at least one of applications or services;
• d) monitoring the behavior of the computer system to detect the one or more procedures of the monitored at least one of applications or services that do not match the expected behaviors of the respective monitored at least one of applications or services defined in the respective behavior profile;
• and
• e) upon detection of the one or more procedures not matching the expected behaviors of the respective monitored at least one of applications or services, identifying said at least one of applications or services as malicious or suspicious.