Claims:WE CLAIM
1. A method of generating cognitive security intelligence for detecting and preventing a malware in a computing system, the method comprising:
monitoring, by a cognitive security device implemented in the computing system, instructions being executed by a processor of the computing system;
determining, by the cognitive security device, a plurality of events triggered by the execution of the instructions and a plurality of activities performed by the execution of the instructions;
correlating, by the cognitive security device, the plurality of events and the plurality of activities to determine a sequence of events and activities;
mapping, by the cognitive security device, the sequence of events and activities with a topographical threat map to detect a pattern match corresponding to the malware, wherein the topographical threat map is event and activity behavior map of a plurality of categories of malwares, and is built based on a cognitive analysis of at least one of external knowledge, or historic knowledge; and
upon detecting the pattern match corresponding to the malware, effecting, by the cognitive security device, a remedial measure to prevent the malware by constructing remedial instructions to be executed by the processor.

2. The method of claim 1, wherein monitoring the instructions being executed by the processor further comprises replicating machine code instructions being executed by the processor.

3. The method of claim 1, wherein the plurality of events comprises at least one of device processes, device services, or registry.

4. The method of claim 1, wherein the plurality of activities comprises activities performed on at least one of memory, data, files, folders, or system configuration.

5. The method of claim 1, wherein detecting the pattern match comprises determining whether the sequence of events and activities is analogous to a sequence of event and activities demonstrated by the malware using the topographical threat map.

6. The method of claim 1, wherein mapping further comprises:
dynamically determining a security risk score and a security threat zone for a set of events from the plurality of events and a set of activities from the plurality of activities; and
predicting a security threat based on the security risk score and the security threat zone.

7. The method of claim 6, wherein effecting the remedial measure comprises effecting the remedial measure based on the predicted security threat.

8. The method of claim 1, wherein the remedial measure comprises at least one of suspending the instructions being executed by the processor, suspending the plurality of events, blocking the plurality of activities, or undoing the changes made by the malware.

9. The method of claim 1, wherein the malware is a ransomware having no pre-configured signature in the cognitive security device.

10. A computing system, comprising:
a cognitive security device for generating cognitive security intelligence for detecting and preventing a malware in the computing system, the cognitive security device comprising at least one processor and a computer-readable medium storing instructions that, when executed by the at least one processor, cause the at least one processor to perform operations comprising:
monitoring instructions being executed by a processor of the computing system;
determining a plurality of events triggered by the execution of the instructions and a plurality of activities performed by the execution of the instructions;
correlating the plurality of events and the plurality of activities to determine a sequence of events and activities;
mapping the sequence of events and activities with a topographical threat map to detect a pattern match corresponding to the malware, wherein the topographical threat map is event and activity behavior map of a plurality of categories of malwares, and is built based on a cognitive analysis of at least one of external knowledge, or historic knowledge; and
upon detecting the pattern match corresponding to the malware, effecting a remedial measure to prevent the malware by constructing remedial instructions to be executed by the processor.

11. The system of claim 10, wherein monitoring the instructions being executed by the processor of the computing system further comprises replicating machine code instructions being executed by the processor of the computing system.

12. The system of claim 10, wherein the plurality of events comprises at least one of device processes, device services, or registry, and wherein the plurality of activities comprises activities performed on at least one of memory, data, files, folders, or system configuration.

13. The system of claim 10, wherein detecting the pattern match comprises determining whether the sequence of events and activities is analogous to a sequence of event and activities demonstrated by the malware using the topographical threat map.

14. The system of claim 10, wherein mapping further comprises:
dynamically determining a security risk score and a security threat zone for a set of events from the plurality of events and a set of activities from the plurality of activities; and
predicting a security threat based on the security risk score and the security threat zone.

15. The system of claim 14, wherein effecting the remedial measure comprises effecting the remedial measure based on the predicted security threat.

16. The system of claim 10, wherein the remedial measure comprises at least one of suspending the instructions being executed by the processor, suspending the plurality of events, blocking the plurality of activities, or undoing the changes made by the malware.

17. The system of claim 10, wherein the malware is a ransomware having no pre-configured signature in the cognitive security device.

Dated this 22nd day of December, 2017

R Ramya Rao
IN/PA-1607
Of K&S Partners
Agent for the Applicant
, Description:TECHNICAL FIELD
This disclosure relates generally to information security, and more particularly to method and system for generating cognitive security intelligence for detecting and preventing malwares.