Patent ID: 8161556
Filing Date: 2012-04-17
Classification: G06F

Abstract:
1. A computer-implemented method for determining, in response to an event of interest, whether to perform a real-time file scan by examining the full context of the event of interest, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: detecting an event of interest; identifying at least one file impacted by the event of interest; accessing contextual metadata associated with the event of interest, the contextual metadata comprising information that identifies: accessing at least one rule that comprises criteria that identifies acceptable usage behavior for files and applications; determining, by applying the rule to both the event of interest and the contextual metadata, whether the event of interest satisfies the criteria that identifies acceptable usage behavior for files and applications; determining, based on whether the event of interest satisfies the criteria that identifies acceptable usage behavior for files and applications, whether to perform a security scan on the file.