Reducing false positives during behavior monitoring

Details Reducing false positives during behavior monitoring Reducing false positives during behavior monitoring

2008-10-20

2011-12-13

Chen, Shin-Hon (Department: 2431)

Information security

Monitoring or scanning of software or data including attack...

Intrusion detection

C726S022000, C726S023000, C726S026000, C713S188000

Reexamination Certificate

active

08079085

ABSTRACT:
A program installed on a computer system registers and is placed on an installed program list or an uninstall software list. A check of the uninstall software list (USL) is added as a secondary verification mechanism to a behavior monitoring engine. A signature-based malware scan engine may be used. If the scan engine does not flag the file as malware, then the behavior monitoring engine monitors the activities performed by the underlying application. When the behavior monitoring engine flags an activity as potentially suspicious, the USL is checked to determine if the application running the process is on the USL. If so, then the process is treated as legitimate and there is no need to alert the user. Only if both the behavior is flagged as suspicious and the application performing the behavior is not on the USL will the user receive an alert as to the potential malware.

REFERENCES:
patent: 7325185 (2008-01-01), Szor
patent: 2005/0071649 (2005-03-01), Shipp
patent: 2005/0223239 (2005-10-01), Dotan
patent: 2005/0257266 (2005-11-01), Cook et al.
patent: 2006/0041942 (2006-02-01), Edwards
patent: 2008/0059198 (2008-03-01), Maislos et al.
patent: 2009/0144823 (2009-06-01), Lamastra et al.
patent: 2009/0319998 (2009-12-01), Sobel et al.
patent: 2010/0313268 (2010-12-01), Abdulhayoglu et al.

Affiliated with

Also associated with

Rating

Reducing false positives during behavior monitoring does not yet have a rating. At this time, there are no reviews or comments for this patent.

If you have personal experience with Reducing false positives during behavior monitoring, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Reducing false positives during behavior monitoring will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFUS-PAI-O-4258945