Malware detection and identification using deviations in one or more operating parameters

Abstract

A method is provided for detecting malware, such as a virus or spyware. The method looks for deviations expected operating parameters instead of focusing solely on conventional malware signatures. The method includes monitoring current operating parameters for a computing system running one or more application, obtaining baseline operating parameters for the computing system running the one or more application in the absence of malware, identifying a deviation between the current operating parameters and the baseline operating parameters, and determining whether the identified deviation matches a deviation associated with a predetermined malware definition.