Integration of inline malware discovery and offline vault ransomware prediction

Abstract

One example method includes, by a first malware detection process, checking an aspect of a production system for evidence of a malware process, identifying the aspects as possibly affected by the malware process, generating cues that identify the aspect, and transmitting the cues to a second malware detection process. The second malware detection process checks the cues to identify the aspect, and determines that the malware process has affected the aspect. The first malware detection process may be an inline process, and the second malware detection process may be an offline process.