Abstract: Disclosed is a system for displaying and capturing file metadata of an application data file stored on a computer; said computer including a processor and memory; said memory storing an operating system for managing operations of the computer; said memory further storing a kernel of the operating system; said computer further including a user interface and at least one installed application installed on said computer for interacting with a user which, when executed by the processor under the control of the operating system, processes said application data file.

Abstract: The present invention provides a system for displaying and capturing file metadata of an application data file stored on a computer; said computer including a processor and memory; said memory storing an operating system for the computer, a kernel of the operating system and Metadata Storage; said computer including a user interface and at least one installed application for interacting with a user which processes said application data file; said system comprising: a Metadata Filter Driver installed on said computer; at least one Metadata Application Thread, which the system injects into said application when a process for execution of said application is created; a Metadata Manager operating on said computer, whereby said Metadata Filter Driver signals said Metadata Manager when said at least one application data file is accessed, which then notifies said Thread appropriate to the at least one installed application which is accessing said application data file.

Abstract: The present invention provides a system for displaying and capturing file metadata of an application data file stored on a computer; said computer including a processor and memory; said memory storing an operating system for the computer, a kernel of the operating system and Metadata Storage; said computer including a user interface and at least one installed application for interacting with a user which processes said application data file; said system comprising: a Metadata Filter Driver installed on said computer; at least one Metadata Application Thread, which the system injects into said application when a process for execution of said application is created; a Metadata Manager operating on said computer, whereby said Metadata Filter Driver signals said Metadata Manager when said at least one application data file is accessed, which then notifies said Thread appropriate to the at least one installed application which is accessing said application data file.

Abstract: A method of detecting malicious activity, including the steps of: intercepting activity in a processing system 100; detecting attributes of an un-assessed process 460 associated with the activity; comparing the process attributes and activity to a database 430 of attributes and activity associated with known malicious and non-malicious processes; and using an inference filter 470 to compute the likely maliciousness of the un-assessed process.