US 12,282,549 B2
Methods and apparatus for malware threat research
Melvyn Morris, Turnditch (GB); Paul Stubbs, Wyboston (GB); Markus Hartwig, Milton Keynes (GB); and Darren Harter, Hucclecote (GB)
Assigned to OPEN TEXT INC., Menlo Park, CA (US)
Filed by Open Text Inc., Menlo Park, CA (US)
Filed on May 23, 2022, as Appl. No. 17/751,275.
Application 13/543,865 is a division of application No. 11/477,807, filed on Jun. 30, 2006, granted, now 8,418,250, issued on Apr. 9, 2013.
Application 17/751,275 is a continuation of application No. 17/011,398, filed on Sep. 3, 2020, granted, now 11,379,582.
Application 17/011,398 is a continuation of application No. 14/313,755, filed on Jun. 24, 2014, granted, now 10,803,170, issued on Oct. 13, 2020.
Application 14/313,755 is a continuation of application No. 13/543,865, filed on Jul. 8, 2012, granted, now 8,763,123, issued on Jun. 24, 2014.
Claims priority of application No. 0513375 (GB), filed on Jun. 30, 2005.
Prior Publication US 2022/0284094 A1, Sep. 8, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/56 (2013.01); G06F 21/57 (2013.01)
CPC G06F 21/56 (2013.01) [G06F 21/577 (2013.01)] 14 Claims
OG exemplary drawing
 
1. A method for monitoring execution of a process for unsafe behavior, comprising:
upon execution of a process, at a monitor agent, searching a database for information relating to the process, wherein the database is a community database stored on a central server and accessed by a plurality of monitor agents executing on client machines;
when information relating to the process is found in the database,
allowing the process to execute and monitoring the execution of the process to determine whether the process is executing within an expected behavior of a pre-authorized mask for the process;
if the process is determined not to be executing with the expected behavior of the pre-authorized mask for the process, issuing an alert; and
if the process is determined to be executing within the expected behavior of the pre-authorized mask for the process, continuing allowing the process to execute and continuing to monitor the process for the expected behavior of the pre-authorized mask for the process; and
when information relating to the process is not found in the database,
allowing the process to execute and monitoring the execution of the process; and
based on said monitoring of the execution of the process, generating a new mask for the process, wherein generating the new mask for the process comprises:
comparing the behavior of the execution of the process to known behaviors,
modifying the new mask based on new behaviors, and
storing the modified new mask in the community database, thereby enabling monitor agents to access the modified new mask when executing the process.