Application Behaviour Control

A method of application behaviour control on a computer system, the method comprising:

• a) matching installed applications with predetermined set of clusters, wherein each application is grouped to a specific cluster on the basis of predefined event profiles, each event profile identifying one or more procedures known to be performed by the associated application;
• b) monitoring procedures that a specific cluster performs;
• c) obtaining a list of expected events and prohibited events of the applications in the specific cluster;
• and
• d) taking further action related to the applications installed on the one or more client computer devices on the basis of the obtained list.

A computer system comprising:

• a processor configured to:
• a) match installed applications with predetermined set of clusters, wherein each application is grouped to a specific cluster on the basis of predefined event profiles, each event profile identifying one or more procedures known to be performed by the associated application;
• b) monitor procedures that a specific cluster performs;
• c) obtain a list of expected events and prohibited events of the applications in the specific cluster;
• and
• d) take further action related to the applications installed on the one or more client computer devices on the basis of the obtained list.

A server comprising:

• a memory configured to store event profiles for applications in a set of clusters, each event profile identifying one or more procedures known to be performed by the associated application;
• a processor configured to:
• a) group applications into the set of clusters, wherein each application is grouped to a specific cluster on the basis of the predefined event profiles for applications in the specific cluster;
• b) monitor procedures that a specific cluster performs on one or more computer devices;
• and
• c) generate a list of expected events and prohibited events of the specific cluster based on monitoring for enabling the one or more client computer devices and/or an administrator of the one or more client computer devices to take further action related to the applications installed on the one or more client computer devices.