System and method for creating a process invocation tree
OwnerRobert Hundt, Stephen Williamsinventors
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for creating a process invocation tree includes identifying an event indicating that a parent process of interest has invoked a child process, suspending execution of the child process, collecting information-of-interest associated with the invocation of the child process, and resuming execution of the child process.
Claims27
A computer-implemented method for creating a process invocation tree comprising:
- identifying an event indicating that a parent process of interest has invoked a child process;
- suspending execution of the child process;
- collecting information-of-interest associated with the invocation of the child process;
- and
- resuming execution of the child process.
A system for creating a process invocation tree comprising:
- means for identifying when a parent process of interest has created a child process;
- and
- means for collecting information corresponding with the parent process of interest's creation of the child process.
A system for creating a process invocation tree comprising:
- a processor;
- a memory coupled to the processor, the memory having an executable instruction set stored thereon, the instruction set comprising:
- logic configured to suspend execution of a child process created by a parent process of interest;
- logic configured to collect information responsive to the creation of the child process;
- and
- logic configured to resume execution of the child process.
A computer-readable medium having stored thereon an executable instruction set comprising logic that when executed by a processor, directs the processor to perform a method, comprising:
- identifying an event indicating that a parent process of interest has invoked a child process;
- suspending execution of the child process;
- collecting information-of-interest associated with the invocation of the child process;
- and
- resuming execution of the child process.
Dependencies are inferred from the claim text.