Method, system and computer program product for detecting at least one of security threats and undesirable computer files

A system for detecting security threats in a computer network, the system comprising:

• means for receiving a data stream which represents outbound, application layer messages from a first computer process to at least one second computer process wherein the computer processes are implemented on one or more computers;
• means for monitoring the data stream to detect a security threat based on a whitelist having entries which contains metadata, the whitelist describing legitimate application layer messages based on a set of heuristics;
• and
• means for generating a signal if a security threat is detected.

A system for detecting undesirable computer files, the system comprising:

• a processor operable to execute computer program instructions;
• a memory operable to store computer program instructions accessible by the processor;
• and
• computer program instructions stored in the memory to perform the step of:
• comparing a set of computer files with a whitelist which characterizes all legitimate computer files wherein the whitelist contains one or more entries, each of the entries describing a plurality of legitimate computer files.

A computer program product for detecting security threats in a computer network, the product comprising:

• a computer readable medium;
• and
• computer program instructions recorded on the medium and executable by a processor for performing the steps of:
• receiving a data stream which represents outbound, application layer messages from a first computer process to at least one second computer process wherein the computer processes are implemented on one or more computers;
• monitoring the data stream to detect a security threat based on a whitelist having entries which contains metadata, the whitelist describing legitimate application layer messages based on a set of heuristics;
• and
• generating a signal if a security threat is detected.

A computer program product for detecting undesirable computer files, the product comprising:

• a computer readable medium;
• and
• computer program instructions recorded on the medium and executable by a processor for performing the step of:
• comparing a set of computer files with a whitelist which characterizes all legitimate computer files wherein the whitelist contains one or more entries, each of the entries describing a plurality of legitimate computer files.