Cyber-attack detection and prevention system

A method for protecting against cyber-attacks on a host machine, where said host machine has an internal or external memory device(s), comprising:

• providing at least one MTS (Memory Traffic Sniffer), connected to the bus lines, of said memory device(s), of said host, for sampling the electrical signals, intended for the said host's physical memory device(s);
• providing at least one MRMU (Memory Reconstruction and Monitoring Unit), connected to said MTS(s), for receiving said sampled signals from said MTS(s) and translating said sampled signals to address and data transactions for reconstructing the physical and virtual memory content of said host, into at least one MLM (Memory Live Mirror) of said host machine;
• providing a memory, connected to said MRMU, for storing said at least one MLM;
• providing an IPU (Integrated Processing Unit), connected to said MRMU(s), and connected to said memory;
• scanning said reconstructed memory content of said host;
• detecting at least one EOI (Entities Of Interest), in said reconstructed memory content of said host, by identifying and analyzing the structure of said at least one EOI;
• and
• monitoring said at least one EOI behavior for suspicious activity;
• and classifying said at least one EOI as legitimate or malicious.