Patent ID: 6944772
Filing Date: 2005-09-13
Classification: G06F,H04L

Abstract:
1. A process for monitoring and analyzing executable computer code comprising the steps of: providing a client computer having an event monitoring application in a working session, said client computer accessing a central computer through a computer network, said central computer having a database comprising a plurality of executable code identity signatures; detecting an event on a client computer by said monitoring application; identifying an executable code associated with an event; creating a unique signature of a said executable code with said monitoring application on said client computer; receiving in said central computer said unique signature; comparing said unique signature with said plurality of executable code identity signatures in said database; forwarding to said central computer for investigation said executable code when said unique signature is absent from plurality of executable code identity signatures; investigating the identity and intent of said executable code if said executable code is unknown; and transmitting from the said central computer to said client computer at least one item selected from the group consisting of: a message and a command to the monitoring application on a said client computer to perform a respective action.