Patent ID: 8307453
Filing Date: 2012-11-06
Classification: G06F

Abstract:
1. A method for detecting a zone breakout comprising: receiving a system call associated with a process, wherein the system call comprises at least one of an attempted system call and an actual system call; determining if the process with which the system call is associated is a new process; determining a first zone in which the process was started; if it is determined the process is a new process, storing information that identifies the new process as having been started in the first zone in a database of process zone information; determining a second zone with which the system call is associated; maintaining the database of process zone information containing zone starting information and subsequent zone information associated with the new process, wherein the database is maintained outside of a global zone containing the first and second zones, and wherein the database stores the information identifying the new process; determining if the first zone is different from the second zone based at least in part on the stored information; and taking responsive action if it is determined that the first zone is different from the second zone, wherein the responsive action comprises: maintaining a separate process to purge data associated with the terminated process from the database.