Anti-malware detection and removal systems and methods

An anti-malware system for mobile communicators which communicate via a circuit switch and via a data switch, said system comprising:

• a malware-characteristic circuit switched communication patterns database which stores malware-characteristic circuit switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said mobile communicators;
• at least one circuit switch monitor associated with said circuit switch for sensing current circuit switched communication patterns being communicated via said circuit switch;
• and
• at least one server, associated with said malware-characteristic circuit switched communication patterns, for comparing said current circuit switched communication patterns sensed by said at least one circuit switch monitor with said malware-characteristic circuit switched communication patterns stored on said malware-characteristic circuit switched communication patterns database and for providing an alert when at least one of said current circuit switched communication patterns is similar to at least one of said malware-characteristic circuit switched communication patterns as indicated by at least one metric.

An anti-malware system for mobile communicators which communicate via a circuit switch and via a data switch, said system comprising:

• a malware-characteristic data switched communication patterns database which stores malware-characteristic data switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said mobile communicators;
• at least one data switch monitor associated with said data switch for sensing current data switched communication patterns being communicated via said data switch;
• and
• at least one server, associated with said malware-characteristic data switched communication patterns, for comparing said current data switched communication patterns sensed by said at least one data switch monitor with said malware-characteristic data switched communication patterns stored on said malware-characteristic data switched communication patterns database and for providing an alert when at least one of said current data switched communication patterns is similar to at least one of said malware-characteristic data switched communication patterns as indicated by at least one metric.

An anti-malware system for mobile communicators which communicate via a circuit switch and via a data switch, said system comprising:

• a malware-characteristic combined patterns database which stores malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said mobile communicators;
• at least one circuit switch monitor associated with said circuit switch for sensing current circuit switched communication patterns being communicated via said circuit switch;
• at least one data switch monitor associated with said data switch for sensing current data switched communication patterns being communicated via said data switch;
• and
• at least one server, associated with said malware-characteristic combined patterns database, operable for comparing combinations of current circuit-switched communication patterns and current data-switched communication patterns sensed by said at least one circuit switch monitor and by said at least one data switch monitor with said malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns stored on malware-characteristic combined patterns database, and for providing an alert when at least one of said combinations of current circuit-switched communication patterns and current data-switched communication patterns are similar to at least one of said malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns as indicated by at least one metric.

A method for detecting malware, the method comprising:

• storing, on at least one database remote from a plurality of computers to be protected:
• identification of said computer applications resident on each of said computers to be protected;
• and,
• an application-specific communications footprint for each of said computer applications;
• and,
• calculating a reference computer-specific communications composite pattern based on multiple application-specific communications footprints for applications installed on each of said computers to be protected;
• calculating a current computer-specific communications composite pattern based on actual communications of at least one of said plurality of computers to be protected;
• providing an alert when said current computer-specific communications composite pattern of said at least one of said plurality of computers to be protected differs from said reference computer-specific communications composite pattern of said at least one of said plurality of computers to be protected as indicated by at least one metric;
• and,
• providing said alert only when the current computer-specific communications composite pattern of the at least one of said plurality of computers to be protected is not included in said non application-specific and said non malware-characteristic communication footprints.

A method for detecting malware for mobile communicators which communicate via a circuit switch and via a data switch, said method comprising:

• storing, on a malware-characteristic circuit switched communication patterns database, malware-characteristic circuit switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said mobile communicators;
• monitoring said circuit switch for sensing current circuit switched communication patterns being communicated via said circuit switch;
• and
• comparing said current circuit switched communication patterns sensed by said monitoring said circuit switch with said malware-characteristic circuit switched communication patterns stored on said malware-characteristic circuit switched communication patterns database and providing an alert when at least one of said current circuit switched communication patterns is similar to at least one of said malware-characteristic circuit switched communication patterns as indicated by at least one metric.

A method for detecting malware for mobile communicators which communicate via a circuit switch and via a data switch, said method comprising:

• storing, on a malware-characteristic data switched communication patterns database, malware-characteristic data switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said mobile communicators;
• monitoring said data switch for sensing current data switched communication patterns being communicated via said data switch;
• and
• comparing said current data switched communication patterns sensed by said monitoring said data switch with said malware-characteristic data switched communication patterns stored on said malware-characteristic data switched communication patterns database and providing an alert when at least one of said current data switched communication patterns is similar to at least one of said malware-characteristic data switched communication patterns as indicated by at least one metric.

A method for detecting malware for mobile communicators which communicate via a circuit switch and via a data switch, said method comprising:

• storing, on a malware-characteristic combined patterns database, malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns which are characteristic of at least one of imminent installation, presence and operation of malware on said mobile communicators;
• monitoring said circuit switch for sensing current circuit switched communication patterns being communicated via said circuit switch;
• monitoring said data switch for sensing current data switched communication patterns being communicated via said data switch;
• and
• comparing combinations of current circuit-switched communication patterns and current data-switched communication patterns sensed by said monitoring said circuit switch and by said monitoring said data switch with said malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns stored on malware-characteristic combined patterns database, and providing an alert when at least one of said combinations of current circuit-switched communication patterns and current data-switched communication patterns are similar to at least one of said malware-characteristic combined circuit-switched communication patterns and data-switched communication patterns as indicated by at least one metric.