0-touch and 1-touch techniques for improving the availability of computer programs under protection without compromising security

A method for protecting software, the method comprising:

• executing the protected software on a computer;
• running a protective software framework on the computer, the protective software framework monitoring the protected software while the protected software executes on the computer, the protective software framework enforcing a security policy;
• detecting a security event by the protective software framework, the security event being a violation of the security policy;
• classifying the security event as one of an attack and a spurious event, the spurious event being caused by benign behavior of the protected software;
• when the security event is classified as a spurious event, accessing information which associates the spurious event with a remediation, and implementing the remediation for the security event, the remediation being a relaxation of the security policy.

A method for protecting software, the method comprising:

• executing protected software on a computer;
• running a protective software framework on the computer, the protective software framework monitoring the protected software while the protected software is executing on the computer, the protective software framework enforcing a security policy;
• detecting, by the protective software framework, a security event caused by the protected software, the security event being a violation of the security policy;
• determining whether the security event is a learned event or an unlearned event, a learned event being a security event that has previously been recorded by the protective software framework when the protective software framework ran in a passive state;
• allowing the protected software to continue running when the security event is determined to be a learned event;
• and
• killing at least one thread of the protected software which caused the security event when the security event is determined to be an unlearned event and the protective software framework is in an active state.

A method for protecting software, the method comprising:

• executing protected software on a computer;
• running a protective software framework on the computer, the protective software framework monitoring the protected software while the protected software executes on the computer, the protective software framework enforcing a security policy;
• detecting at least one new application and/or DLL in the protected software as a result of the monitoring of the protected software by the protective software framework;
• and
• determining whether the at least one new application and/or DLL has been classified as:
• an entity which is known to be well-behaved, or an entity which is known to possess bad properties;
• otherwise, classifying the at least one new application and/or DLL as an unknown entity;
• wherein the classifying of the at least one new application and/or DLL as an unknown entity further comprises classifying the at least one new application and/or DLL as an entity which is observed by associated protective software to have bad properties which were remediated by a relaxation of the security policy;
• and
• allowing the at least one new application and/or DLL to execute when the at least one new application and/or DLL is determined to be an entity which is observed by the associated protective software to have bad properties which were remediated according to the relaxation of the security policy.

A method for protecting software, comprising:

• executing protected software on a computer;
• running a protective software framework to monitor the protected software while the protected software executes on the computer, the protective software framework enforcing a security policy;
• detecting, by the protective software framework, a security event caused by the protected software, the security event being a violation of the security policy;
• determining whether the security event occurs within a defined time window;
• when the security event occurs within the defined time window, treating the security event as a benign event wherein the protected software is allowed by the protective software framework to continue executing uninterrupted;
• and
• when the security event occurs outside the defined time window, treating the security event as an attack wherein a thread of the protected software is killed by the protective software framework or an exception is thrown.

Storage medium for protecting software, the storage medium having a protective software framework embodied on the storage medium, the protective software framework comprising processor readable code that when executed causes a computer to perform a method, the method comprising:

• monitoring protected software while the protected software executes on the computer, the protective software framework enforcing a security policy;
• detecting a security event caused by the protected software the security event being a violation of the security policy;
• classifying the security event as one of an attack and a spurious event, the spurious event being a benign behavior of the protected software;
• when the security event is classified as a spurious event, accessing information which associates the spurious event with a remediation, and implementing the remediation for the security event, the remediation being a relaxation of the security policy.

Storage medium for protecting software, the storage medium having a protective software framework embodied on the storage medium, the protective software framework comprising processor readable code that when executed causes a computer to perform a method, the method comprising:

• monitoring protected software while the protected software executes on the computer, the protective software framework enforcing a security policy;
• detecting at least one new application and/or DLL in the protected software as a result of the monitoring of the protected software by the protective software framework;
• determining whether the at least one new application and/or DLL has been classified as:
• an entity which is known to be well-behaved, or an entity which is known to possess bad properties;
• otherwise, classifying the at least one new application and/or DLL as an unknown entity
• wherein the classifying of the at least one new application and/or DLL as an unknown entity further comprises classifying the at least one new application and/or DLL as an entity which is observed by associated protective software to have bad properties which were remediated by a relaxation of the security policy;
• and
• allowing the at least one new application and/or DLL to execute when the at least one new application and/or DLL is determined to be an entity which is observed by the associated protective software to have bad properties which were remediated according to the relaxation of the security policy.

Storage medium for protecting software, the storage medium having a protective software framework embodied on the storage medium, the protective software framework comprising processor readable code that when executed causes a computer to perform a method, the method comprising:

• monitoring protected software, the monitoring comprises enforcing a security policy;
• detecting a security event caused by the protected software, the security event being a violation of the security policy;
• determining whether the security event occurs within a defined time window;
• when the security event occurs within the defined time window, treating the security event as a benign event wherein the protected software is allowed by the protective software framework to continue executing uninterrupted;
• and
• when the security event occurs outside the defined time window, treating the security event as an attack whereby a thread of the protected software is killed by the protective software framework or an exception is thrown.