Back to results
US 11,070,573 B1Granted
Process tree and tags
AssigneeCapsule8, Inc.
InventorBrandon M. Edwards
Life of this patent
Estimating the term…
Abstract
Information associated with a process is received. At least a portion of the received information is used to modify a Process Tree. Modifying the Process Tree includes at least one of: (1) adding a Tag to the Process Tree and (2) modifying a Tag in the Process Tree. An Alert is generated based at least in part in response to determining that a Strategy has been matched.
Claims35
A system, comprising:
- a processor configured to:
- receive information associated with a process;
- use at least a portion of the received information to modify a Process Tree, wherein modifying the Process Tree includes at least one of:
- (1) adding a Tag to the Process Tree, including by adding a new authorized heir Tag to the Process Tree in response to determining that an original authorized shell process is still alive, and (2) modifying a Tag in the Process Tree;
- return a NIL in response to determining that the original authorized shell process is dead;
- and
- generate an Alert, based at least in part in response to determining that a Strategy has been matched;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
6 more elements
A method, comprising:
- receiving information associated with a process;
- using at least a portion of the received information to modify a Process Tree, wherein modifying the Process Tree includes at least one of:
- (1) adding a Tag to the Process Tree, including by adding a new authorized heir Tag to the Process Tree in response to determining that an original authorized shell process is still alive, and (2) modifying a Tag in the Process Tree;
- returning a NIL in response to determining that the original authorized shell process is dead;
- and
- generating an Alert, based at least in part in response to determining that a Strategy has been matched.
3 more elements
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- receiving information associated with a process;
- using at least a portion of the received information to modify a Process Tree, wherein modifying the Process Tree includes at least one of:
- (1) adding a Tag to the Process Tree, including by adding a new authorized heir Tag to the Process Tree in response to determining that an original authorized shell process is still alive, and (2) modifying a Tag in the Process Tree;
- returning a NIL in response to determining that the original authorized shell process is dead;
- and
- generating an Alert, based at least in part in response to determining that a Strategy has been matched.
3 more elements
Dependencies are inferred from the claim text.