Patent ID: 8341736
Filing Date: 2012-12-25
Classification: G06F

Abstract:
1. A method arranged for operating on a computer system, the method for dynamically handling a suspected threat, the method comprising the steps of: monitoring file activity to ascertain when a file is being opened or having been modified and closed; scanning the file, responsively to the monitoring, to identify a threat associated with the file, the threat being identified by alert level or threat level by comparing the file against a set of stored signatures; and applying a cascading logic hierarchy to the identified threat, the cascading logic hierarchy including a plurality of tiers, each tier in the plurality of tiers providing a configuration for the computer system that is usable for determining whether to run or suspend software embodying the threat, each higher tier in the logic hierarchy being arranged for overriding a configuration contained in a lower tier in a cascading manner, wherein the cascading logic hierarchy includes a tier which provides a policy-defined action associated with a group policy setting, the cascading logic hierarchy further includes a tier which provides a user-defined action associated with an end-user preference, wherein the policy-defined action associated with the group policy setting overrides the user-defined action associated with the end-user preference, and the cascading logic hierarchy further includes a tier which provides a signature-defined action associated with an anti-malware definition, wherein the user-defined action associated with the end-user preference overrides the signature-defined action associated with the anti-malware definition.