Patent ID: 7694150
Filing Date: 2010-04-06
Classification: G06F,H04L

Abstract:
1. A method for preventing undesirable activity in an information processing environment comprising: developing a heuristic operable to identify suspect behavior in the information processing environment; employing the developed heuristic for identifying a corresponding malicious object as a conveyance of an undesirable result of the suspect behavior; creating a signature indicative of the identified malicious object, the signature computed from at least a portion of the malicious object and operable to indicate the malicious object; computing a signature on the potential malicious object; upon introduction of the malicious object, examining a repository of local quarantined signatures and comparing the computed signature with at least one of the signatures in the repository of local quarantined signatures and previously created signatures indicative of a malicious object such that subsequent propagation of the malicious object is prevented; wherein comparing the computed signature comprises at least one of examining a remote server based anti virus set, and a cached set of recently quarantined signatures via a master console; identifying a potential malicious object associated with the identified actions; detecting, via the heuristic, whether the identified actions are indicative of suspect behavior; and determining the existence of undesirable activity if either the heuristic indicates a correspondence with suspect behavior or the computed signature corresponds with the previously created signatures indicative of a malicious object.