Methods and apparatus providing security to computer systems and networks

A method of preventing performance of processing operations that produce processing outcomes that violate a security policy in a computerized device, the method comprising:

• operating a plurality of security interceptors that monitor operation of different respective processing activities of the computerized device to detect a sequence of related processing operations within the computerized device for those respective processing activities;
• recording, in a security history, the sequence of related processing operations for each processing activities in the computerized device;
• identifying an undesired processing operation and in response, comparing the security history to at least one formerly collected security history to identify a common sequence of related processing operations that occurred in each security history before occurrence of the undesired processing operation, and in response, marking that common sequence of related processing operations as being a disallowed sequence of related processing operations in the security policy;
• and
• operating the plurality of security interceptors to subsequently detect attempted performance of the disallowed sequence of related processing operations, and in response, denying operation of the disallowed sequence of related processing operations by at least one of the processing activities within the computerized device to avoid violation of the security policy.

A computerized device comprising:

• a memory;
• a processor;
• a communications interface coupled to a network;
• an interconnection mechanism coupling the memory, the processor and the communications interface;
• wherein the memory is encoded with a security agent, that when executed on the processor, causes the processor to perform the operations of:
• operating a plurality of security interceptors that monitor operation of different respective processing activities of the computerized device to detect a sequence of related processing operations within the computerized device for those respective processing activities;
• recording, in a security history, the sequence of related processing operations for each processing activities in the computerized device;
• identifying an undesired processing operation and in response, causing comparison of the security history to at least one formerly collected security history to identify a common sequence of related processing operations that occurred in each security history before occurrence of the undesired processing operation, and in response, marking that common sequence of related processing operations as being a disallowed sequence of related processing operations in the security policy;
• and
• operating the plurality of security interceptors to subsequently detect attempted performance of the disallowed sequence of related processing operations, and in response, denying operation of the disallowed sequence of related processing operations by at least one of the processing activities within the computerized device to avoid violation of the security policy.

A computer readable medium including computer program logic instruction encoded thereon, that when executed on a processor in a computerized device, prevent performance of processing operations that produce processing outcomes that violate a security policy in the computerized device, by causing the computerized device to perform the operations of:

• operating a plurality of security interceptors that monitor operation of different respective processing activities of the computerized device to detect a sequence of related processing operations within the computerized device for those respective processing activities;
• recording, in a security history, the sequence of related processing operations for each processing activities in the computerized device;
• identifying an undesired processing operation and in response, comparing the security history to at least one formerly collected security history to identify a common sequence of related processing operations that occurred in each security history before occurrence of the undesired processing operation, and in response, marking that common sequence of related processing operations as being a disallowed sequence of related processing operations in the security policy;
• and
• operating the plurality of security interceptors to subsequently detect attempted performance of the disallowed sequence of related processing operations, and in response, denying operation of the disallowed sequence of related processing operations by at least one of the processing activities within the computerized device to avoid violation of the security policy.