Malware detection
OwnerVarun SETHinventor
Life of this patent
Estimating the term…
Abstract
Approaches for detecting and rectifying the malware in the computing systems are described. In an example, a request by a process or is intercepted by the malware detection module. Relevant information and characteristics pertaining to the request are extracted and on the based on the extraction, operational attributes are generated. These extracted operational attributes are analyzed and compared with the baseline attributes and if there are any anomalies present, the susceptible code or process originating from the intercepted request is ascertained as malicious.
Claims20
A method for detecting and rectifying the malware threats in a computing system, the method comprising:
- intercepting a request from a process, wherein the process is to implement a plurality of functions to be caused pursuant to the execution of a susceptible code;
- extracting operational attributes from the request based on the intercepted request affected by the execution of the program;
- and
- analyzing extracted operational attributes based on baseline attributes for evaluating the susceptible code to be malicious or benign, wherein the baseline attributes comprise characteristics corresponding to operations known to be performed by malware.
A system comprising:
- a processor;
- a malware detection module coupled to the processor, wherein the malware detection module is to:
- intercepting a request from a process, by the system, wherein process is to implement a plurality of functions caused pursuant to the execution of susceptible code;
- extract operational attributes from the request based on the intercepted request affected by the execution of the program;
- and
- analyze operational attributes based on baseline attributes for evaluating the susceptible code to be malicious or benign, wherein the baseline attributes comprise characteristics corresponding to operations known to be performed by malware.
A non-transitory computer-readable medium comprising computer-readable instructions being executable by a processing resource to:
- intercept a request from a process, by the system, wherein process is to implement a plurality of functions caused pursuant to the execution of susceptible code;
- extract operational attributes from the request based on the intercepted request;
- and
- analyze extracted operational attributes based on baseline attributes for evaluating the susceptible code to be malicious or benign, wherein the baseline attributes comprise characteristics corresponding to operations known to be performed by malware.
Dependencies are inferred from the claim text.