Patent ID: 9141812
Filing Date: 2015-09-22
Classification: G06F,G06N

Abstract:
1. A method of implementing a processing policy on a computer, comprising: using a computer, detecting first and second events, each having one of a plurality of defined event types and each produced by one of a plurality of defined processes; generating first information about the first event and second information about the second event; based on the first information and the second information, determining an event pattern in which the first event and the second event occurred; determining a first application name of a first application that was running in a first process, of the plurality of defined processes, that produced the first event; determining a second application name of a second application that was running in a second process, of the plurality of defined processes, that produced the second event; determining, based, at least in part, on the event pattern, the first application name and the second application name, a set of rules for identifying one or more permissible resources; using the computer, enforcing a policy responsive to the first information about the first event and the second information about the second event by applying the set of rules to the first information and the second information.