Patent ID: 7290266

Claim:
A computer-implemented reference monitor, comprising: a monitoring process, executing on a computer, which detects plural defined events and generates event messages; a storage device, on the computer, in which is stored real-time state information related to the event messages generated by the monitoring process; and a rule interpreting process, executing on the computer, which responds to characteristics of an event message of the information stored in the storage device and a set of rules by modifying operation of the computer by selectively computing a decision to allow or block activity according to the set of rules, the rule interpreting process further comprising: plural interceptors for identifying the activity; at least one rule which defines permissible resource references in view of an activity identified by the interceptors and the real-time state information, the interceptors operable to receive a sequence of events indicative of requests for operating system resources, the set of rules collectively defining a processing policy; and a rule interpreter which applies the rule to the identified activity and the real-time state information, the monitoring process operable to: operate in a state collection mode, the state collection mode operable for gathering normal patterns of activity; subsequently operate in a lockdown mode, the lockdown mode operable to detect and distinguish predetermined patterns of events and the gathered normal patterns of activity; identify detected patterns as unsafe based on user selection; and implement the decision to block or allow the identified activity.