Systems and methods for classifying an unclassified process as a potential trusted process based on dependencies of the unclassified process
AssigneeSymantec Corporation
InventorsSourabh Satish, Shane Pereira, Adam Glick
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for classifying an unclassified process as a potentially trusted process based on dependencies of the unclassified process is described. A component loaded by the unclassified process is identified. A determination is made as to whether a hard dependency exists between the unclassified process and the loaded component. A hard dependency exists if the unclassified process depends on the loaded component in order to execute. The unclassified process is classified as a potentially trusted process if a hard dependency exists between the unclassified process and the loaded component.
Claims18
A computer-implemented method for classifying an unclassified process as a potentially trusted process based on dependencies of the unclassified process, comprising:
- identifying a component loaded by the unclassified process;
- determining whether software code from the unclassified process depends on the component loaded by the unclassified process in order to execute, wherein the determining comprises, at least in part, identifying a file system directory in which the unclassified process is located and a file system directory in which the loaded component is located;
- and
- upon determining that the software code from the unclassified process depends on the loaded component in order to execute, classifying the unclassified process as a potentially trusted process.
A computer system configured to classify an unclassified process as a potentially trusted process based on dependencies of the unclassified process, comprising:
- a processor;
- memory in electronic communication with the processor;
- instructions stored in the memory, the instructions being executable by the processor to:
- identify a component loaded by the unclassified process;
- determine whether software code from the unclassified process depends on the component loaded by the unclassified process in order to execute, wherein the instruction to determine comprises, at least in part, an instruction to identify a file system directory in which the unclassified process is located and a file system directory in which the loaded component is located;
- and
- upon determining that the software code from the unclassified process depends on the loaded component in order to execute, classify the unclassified process as a potentially trusted process.
A computer-program product for classifying an unclassified process as a potentially trusted process based on dependencies of the unclassified process, the computer-program product comprising a non-transitory computer-readable medium storing instructions thereon, the instructions being executable by the processor to:
- identify a component loaded by the unclassified process;
- determine whether software code from the unclassified process depends on the component loaded by the unclassified process in order to execute, wherein the instruction to determine comprises, at least in part, an instruction to identify a file system directory in which the unclassified process is located and a file system directory in which the loaded component is located;
- and
- upon determining that the software code from the unclassified process depends on the loaded component in order to execute, classify the unclassified process as a potentially trusted process.
Dependencies are inferred from the claim text.