Method and system for generating cognitive security intelligence for detecting and preventing malwares

A computing system, comprising:

• a cognitive security device for generating cognitive security intelligence for detecting and preventing a malware in the computing system, the cognitive security device comprising at least one processor and a computer-readable medium storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
• monitoring instructions being executed by a processor of the computing system;
• determining a plurality of events triggered by the execution of the instructions and a plurality of activities performed by the execution of the instructions;
• correlating the plurality of events and the plurality of activities to determine a sequence of events and activities;
• mapping the sequence of events and activities with a topographical threat map to detect a pattern match corresponding to the malware, wherein the topographical threat map is event and activity behavior map of a plurality of categories of malwares, and is built based on a cognitive analysis of at least one of external knowledge, or historic knowledge;
• and
• upon detecting the pattern match corresponding to the malware, effecting a remedial measure to prevent the malware by constructing remedial instructions to be executed by the processor.

A non-transitory computer-readable medium storing computer-executable instructions for:

• monitoring instructions being executed by a processor of a computing system;
• determining a plurality of events triggered by the execution of the instructions and a plurality of activities performed by the execution of the instructions;
• correlating the plurality of events and the plurality of activities to determine a sequence of events and activities;
• mapping the sequence of events and activities with a topographical threat map to detect a pattern match corresponding to a malware, wherein the topographical threat map is event and activity behavior map of a plurality of categories of malwares, and is built based on a cognitive analysis of at least one of external knowledge, or historic knowledge;
• and
• upon detecting the pattern match corresponding to the malware, effecting a remedial measure to prevent the malware by constructing remedial instructions to be executed by the processor.