Patent ID: 9703961
Date: 2017-07-11
CPC Classifications: G06F

Claim:
1. A computer-implemented method comprising: receiving, at a process risk classifier running on a computer system, a request to determine a risk level for a particular process; accessing, by the process risk classifier, one or more signatures for the particular process that provide one or more snapshots of characteristics of the particular process at one or more previous times; identifying, by the process risk classifier, one or more differences between the particular process in its current form and the one or more signatures for the particular process; accessing, by the process risk classifier, information identifying previous usage of the computer system's resources by the particular process; accessing, by the process risk classifier, a tree data structure that represents one or more dependencies for the particular process and other processes installed on the computer system; determining, by the process risk classifier, a current risk score for the particular process based, at least in part, on (i) the one or more signatures for the particular process, (ii) the one or more differences between the particular process in its current form and the one or more signatures, (iii) the previous usage of the resources, and (iv) an indication of which of one or more of paths that are associated with the particular process in the tree data structure; and providing, by the process risk classifier, the current risk score for the particular process.