Patent ID: 8578345
Filing Date: 2013-11-05
Classification: G06F

Abstract:
1. A computer implemented method for identifying installation and uninstallation scenarios, and exempting processes associated therewith from anti-malware analysis, the method comprising the steps of: detecting, by a computer, a launch of a process from an application from a group of applications consisting of: an installer and an uninstaller; creating, by a computer, a process lineage tree representing the detected launched process and all processes launched directly and indirectly thereby; representing, by a computer, the detected launched process by a root node in the process lineage tree; tracking, by a computer, launches of child processes by the detected launched process and by any subsequently launched child processes, said subsequently launched child processes comprising child processes launched by the detected launched process and child processes launched by any subsequently launched child process; representing, by a computer, subsequently launched child processes by child nodes in the process lineage tree; and exempting, by a computer, the processes represented by nodes in the process lineage tree from anti-malware analysis.