Runtime Adaptive Risk Assessment and Automated Mitigation

A system for detecting and mitigating malware in a device, said system comprising:

• a) said device having one or more sensors or actuators, and a computer processor able to operate said sensors or actuators, wherein the device is able to be connected to a network or external computer system;
• b) a first module implemented on the computer processor able to operate said one or more sensors or actuators in a base operational mode and operate said one or more sensors or actuators in one or more higher operational modes;
• c) a second module implemented on the computer processor able to estimate a probability that a malware risk will effect a function performed by said one or more sensors or actuators in said one or more higher operational modes;
• d) an optional third module implemented on the computer processor able to model normal system behavior of the base operational mode and one or more higher operational modes of the device, compare current system operation to the modeled normal system behavior, and estimate a probability of the current system operation being affected by malware based on performance deviation between the current system operation and the modeled normal system behavior;
• and
• e) a fourth module implemented on the computer processor able to analyze the estimated probabilities from the second and third modules and cause the first module to switch from the one or more higher operational modes to a higher operational mode having less functionality or to the base operational mode when the estimated probabilities exceed a calculated risk threshold.