Arrangement and method of threat detection in a computer or computer network

An arrangement for threat detection in a computer or computer network, wherein the arrangement comprises at least one computer, wherein the at least one computer is configured:

• to start and/or initialize a virtual machine or a software emulator in response to starting a software application at a local machine, and to pass the software application to the virtual machine or the software emulator,
• to determine and back-up changes made by the software application run on the local machine to at least one file and/or system configuration value of the local machine,
• to concurrently analyze application events and/or behavior at the virtual machine or the software emulator to determine malicious behavior of the application while running the software application at the local machine,
• in response to detecting malicious behavior of the software application at the virtual machine or the software emulator, to notify the local machine about the malicious behavior and to end the virtual machine or a session of the software emulator,
• in response to receiving the notification about the malicious behavior of the software application, to terminate the software application at the local machine and revert changes made by the software application to the at least one file and/or system configuration value based on the backed-up version of the at least one file and/or system configuration value.

A computer program product comprising at least one non-transitory computer-readable medium having computer-executable instructions which, when executed by a computer, cause the computer to:

• start and/or initialize a virtual machine or a software emulator in response to starting a software application at a local machine, and pass the software application to the virtual machine or the software emulator;
• determine and back-up changes made by the software application run on the local machine to at least one file and/or system configuration value of the local machine;
• concurrently analyze application events and/or behavior at the virtual machine or the software emulator to determine malicious behavior of the software application while running the software application at the local machine;
• in response to detecting malicious behavior of the software application at the virtual machine or the software emulator while the software application is running at the local machine, notify the local machine about the malicious behavior and end the virtual machine or a session of the software emulator;
• and
• in response to receiving the notification about the malicious behavior of the software application, terminate the software application at the local machine and revert changes made by the software application or to the at least one file and/or system configuration value based on the backed-up version of the at least one file and/or system configuration value.

A non-transitory computer-readable medium comprising a memory having instructions stored thereon which when executed by a processor cause the processor to:

• start and/or initialize a virtual machine or a software emulator in response to starting a software application at a local machine, and pass the software application to the virtual machine or the software emulator;
• determine and back-up changes made by the software application run on the local machine to at least one file and/or system configuration value of the local machine;
• concurrently analyze application events and/or behavior at the virtual machine or the software emulator to determine malicious behavior of the software application while running the software application at the local machine;
• in response to detecting malicious behavior of the software application at the virtual machine or the software emulator while the software application is running at the local machine, notify the local machine about the malicious behavior and end the virtual machine or a session of the software emulator;
• and
• in response to receiving the notification about the malicious behavior of the software application, terminate the software application at the local machine and revert changes made by the software application or to the at least one file and/or system configuration value based on the backed-up version of the at least one file and/or system configuration value.