Patent ID: 9081967
Filing Date: 2015-07-14
Classification: G06F,H04L

Abstract:
1. A method for protecting a computer system from software vulnerabilities, the method comprising: determining, by a hardware processor, whether an application includes one or more vulnerabilities affecting at least one of a security of the application, security of data used by the application, and security of an operating system of the computer system; creating a definitive list of typical actions that includes a process of at least following three stages for protecting the computer system from software vulnerabilities: in a first stage, generating a first list of typical actions performed by the application based on response information collected from a query sent to a plurality of external information sources, including at least a remote antivirus server, wherein if an action was not discovered from at least one of the plurality of external information sources, then the action is not added to the list of the first typical actions; in a second stage, compiling a second list of typical actions by removing one or more actions of the application used by an exploit from the list of typical actions performed by the application, wherein said second list of typical actions is collected at least through an analysis during the execution of the application; in a third stage, comparing the first and the second lists of the typical actions compiled in the first and second stages and compiling the definitive list of typical actions based on comparison of the first and the second lists of the typical actions; configuring one or more restriction rules based on the definitive list of typical actions to eliminate the one or more vulnerabilities, wherein a restriction rule allows the application to perform typical actions and blocks anomalous actions; and controlling the execution of the application using the restriction rules.