Determining a reputation for a process
AssigneeMcAfee, Inc.
InventorJoel R. Spurlock
Life of this patent
Estimating the term…
Abstract
Particular embodiments described herein provide for an electronic device that can be configured to identify a process running on the electronic device, assign a reputation to the process if the process has a known reputation, determine if the process includes executable code, determine a reputation for the executable code, and combine the reputation for the executable code with the reputation assigned to the process to create a new reputation for the process.
Claims25
At least one non-transitory, computer-readable medium comprising one or more instructions that, when executed by at least one processor, cause the at least one processor to perform a method comprising:
- identifying a process, wherein the process includes executable code that interacts with an electronic device, and a reputation is assigned to the process;
- determining a reputation for the executable code;
- combining the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process;
- and,
- in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merging the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
An apparatus, comprising:
- a processor configured to
- identify a process, wherein the process includes executable code that interacts with an electronic device, and a reputation is assigned to the process;
- determine a reputation for the executable code;
- combine the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process;
- and,
- in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merge the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
A method, comprising:
- identifying a process, wherein the process includes executable code that interacts with an electronic device, and a reputation is assigned to the process;
- determining a reputation for the executable code;
- combining the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process;
- and,
- in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merging the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
A system for determining a reputation of a process, the system comprising:
- a memory including instructions;
- and
- a processor that executes the instructions to become configured for
- identifying the process, wherein the process includes executable code that interacts with an electronic device, and the reputation is assigned to the process;
- determining a reputation for the executable code;
- combining the reputation for the executable code and a reputation of the electronic device with the reputation assigned to the process to update the reputation for the process;
- and,
- in response to determining a thread is attached to the process by an actor process in order to bypass a firewall rule, merging the reputation assigned to the process and a reputation of the actor process or the thread to protect a resource of a computer.
Dependencies are inferred from the claim text.