Arrangement and method of threat detection in a computer or computer network

Abstract

An arrangement (410 figure 4) and a method, e.g. a computer implemented method, of threat detection in a computer or computer network. Comprises determining that an application (e.g. malware) is starting at a computer 1, such as a network node or an endpoint. Monitoring the application for a predetermined duration after the application starts in order to recognize malicious activity by the application. The monitoring of the application comprises monitoring the application for accessing a predefined storage area, e.g. a security sensitive area, of the computer. If access to the predefined storage area, e.g. the security sensitive area, is determined during the monitoring, denying access to the predefined storage area of the computer for the monitored application and / or denying or throttling network access of the monitored application. The method may after the predetermined time has passed and no suspicious or threatening activity is detected, allowing access to the application. The method may include identifying the application and retrieving a reputation rating of the application.

Images