Patent ID: 6681331
Filing Date: 2004-01-20
Classification: G06F

Abstract:
A method for detecting an intrusive use of a computer system through the dynamic measurement of software activity, comprising the steps of:(a) within an internal operating environment on the computer system, but not limited to an operating system, causing the computer system to monitor control transfer respectively to and possibly from each of a plurality of program modules executing on the computer system, and execution profile data, said execution profile data identifying the modules that have executed within a period of time; (b) at least temporarily retaining the execution profile data; (c) estimating a nominal computer system behavior as a function of said execution profile data, while no intrusive use of the computer system is occurring; and (d) detecting at least a potential intrusive use, if a change in the execution profile data indicates computer system behavior that deviates substantially from the nominal computer system behavior.