Abstract: Detecting synthetic keystrokes by maintaining a record of one or more keystrokes of physical keyboard input detected by an operating system of a computer, detecting a keystroke received at a computer application process that is executed by the computer, determining that the keystroke received at the computer application process is absent from the record of keystrokes of physical keyboard input, and identifying the keystroke received by the computer application process as being a synthetic keystroke.

Abstract: Detecting synthetic keystrokes by maintaining a record of one or more keystrokes of physical keyboard input detected by an operating system of a computer, detecting a keystroke received at a computer application process that is executed by the computer, determining that the keystroke received at the computer application process is absent from the record of keystrokes of physical keyboard input, and identifying the keystroke received by the computer application process as being a synthetic keystroke.

Abstract: Preventing unauthorized access to computer software applications by receiving keyboard event information corresponding to a plurality of keyboard events detected at a computer, wherein the keyboard events represent input to a computer software application, determining that a number of paste actions indicated by the keyboard event information equals or exceeds a predefined threshold, and performing a computer-security-related action responsive to determining that the number of paste actions equals or exceeds the predefined threshold, wherein the computer-security-related action relates to the computer software application.

Abstract: In a computer system, a method detects a suspected malware behavior. Activities on a computer system conducted within a given time frame are monitored during the installation of a suspected file. The monitored activities are recorded and the monitored/recorded activities are compared with patterns of malware behavior, stored in a database. Upon detecting a suspicious program, the recorded monitored activities are provided for further analysis to be performed by appropriate software removal tools.

Abstract: A method for detecting and removing a suspicious software code in a computer system, according to which the installation process of the suspicious software code is monitored by a client agent residing within the computer system where predetermined operations of the suspicious software code are identified and registered during the installation process. The predetermined operations are compared with a known software code in order to define whether the software code is similar to the known software code. It is then determined if the suspicious software code is malware and if it is, the client agent is instructed to uninstall the suspicious software code from the OS, or to remove its entry from the boot registry.

Abstract: A method for detecting network attacks is provided. In one implementation, the method receives a plurality of attack indications based on data transmitted on the network and applies rules to the plurality of attack indications. Also, the method generates an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack. In addition, a network device that performs the method and a computer program corresponding to the method are provided.

Abstract: A method for detecting network attacks is provided. In one implementation, the method receives a plurality of attack indications based on data transmitted on the network and applies rules to the plurality of attack indications. Also, the method generates an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack. In addition, a network device that performs the method and a computer program corresponding to the method are provided.

Abstract: A method for detecting network attacks is provided. In one implementation, the method receives a plurality of attack indications based on data transmitted on the network and applies rules to the plurality of attack indications. Also, the method generates an alert if an application of at least a subset of the rules on the plurality of attack indications indicates a potential attack. In addition, a network device that performs the method and a computer program corresponding to the method are provided.