Abstract: There is provided a system and a computerized method of remediating one or more operations linked to a given program running in an operating system, the method comprising: querying a stateful model to retrieve a group of entities related to the given program; terminating at least a sub set of the group of entities related to the given program; generating a remediation plan including one or more operations linked to the given program, the one or more operations being retrieved based on the group in the stateful model; and executing the remediation plan by undoing at least part of the one or more operations linked to the given program thereby restoring state of the operating system to a state prior to the given program being executed. There is further provided a computerized method of detecting malicious code related to a program in an operating system in a live environment.

Abstract: A computer implemented method for securing at least one of files and records related to a specific process, the method comprising obtaining interaction data comprising one or more persons and one or more files and/or records, said interaction data comprises a process interaction score between at least one user and the specific process; identifying, from the interaction data, one or more persons and one or more files and/or records related to the specific process; comparing a process threshold with a process interaction score between a target user and the specific process; and in response to the comparison satisfying a rule, performing a security operation on the one or more files and/or records related to the specific process.

Abstract: A computer implemented method for securing at least one of files and records related to a specific process, the method comprising obtaining interaction data comprising one or more persons and one or more files and/or records, said interaction data comprises a process interaction score between at least one user and the specific process; identifying, from the interaction data, one or more persons and one or more files and/or records related to the specific process; comparing a process threshold with a process interaction score between a target user and the specific process; and in response to the comparison satisfying a rule, performing a security operation on the one or more files and/or records related to the specific process.

Abstract: Securing files and/or records related to a specific process by obtaining interaction data including one or more persons and one or more files and/or records, the interaction data including a process interaction score between at least one user and the specific process, identifying, from the interaction data, one or more persons and one or more files and/or records related to the specific process, comparing a policy threshold with a process interaction score between a specific file or record and the specific process, and in response to the comparison satisfying a rule, setting in a database a security policy on the specific file or record.