Kernel-based proactive engine for malware detection

A method for detecting malware comprising:

• in response to a system call being made, creating a feature vector for a system call function that is invoked when the system call is made, the feature vector defining a plurality of features including at least two of:
• a number of steps feature;
• a delete count feature;
• an open count feature;
• a create count feature;
• a by user feature;
• a new system feature;
• or
• a via library feature;
• evaluating the feature vector using a multidimensional anomaly detection algorithm to thereby generate a score indicating whether the feature vector is anomalous;
• and
• when the score indicates that the feature vector is anomalous, blocking the system call, whereas when the score indicates that the feature vector is not anomalous, allowing the system call.