Arrangement and a method of threat detection in a computing device or a computer network

An arrangement for threat detection in a computer or computer network, wherein the arrangement comprises at least one computing device, wherein the computing device is configured:

• to determine that a financial related service is accessed with the computing device,
• to determine during an active session or connection to the financial related service that an application or process of the computing device is requesting use of network access of the computing device,
• to check the reputation of the application or the process and based on the checked reputation of the application or the process:
• to block network access of the application or the process if the application or process is not a trusted application or a trusted process,
• to scan memory of the computing device used by the application for malicious or unusual content if the application is a trusted application or the process is a trusted process, and
• if scanning indicates no malicious or unusual content, to grant network access to the application, and
• if scanning of the application indicates malicious or unusual content to block network access for the application.

A non-transitory computer-readable medium on which is stored a computer program comprising instructions which, when executed by a computer, cause the computer to carry out a method of threat detection in a computing device or a computer network, wherein the method comprises:

• determining that a financial related service is accessed with the computing device,
• determining during an active session or connection to the financial related service that an application or process of the computing device is requesting use of network access of the computing device,
• checking the reputation of the application or process and based on the checked reputation of the application or the process:
• blocking network access of the application or the process if the application or the process is not a trusted application or a trusted process,
• scanning memory of the computing device used by the application or the process for malicious or unusual content if the application is a trusted application or the process is a trusted process, and
• if scanning indicates no malicious or unusual content, granting network access to the application or the process, and
• if scanning of the application or the process indicates malicious or unusual content, blocking network access for the application or the process.