Patent ID: 8220054

Claim:
A method of updating a process exception list for use in a malware behavior monitoring program, the method comprising: receiving a plurality of client process reports from a first plurality of client devices having malware behavior monitoring programs, wherein a client process report includes malware behavior monitoring program CPU usage data relating to one or more processes executing on a client device; creating a statistics summary report from analyzing the plurality of client process reports; determining whether to add a process to a final exception list wherein the determination is made using the statistics summary report by examining an average performance impact of the process across multiple client devices and a number of client devices reporting the process; and distributing the final exception list to a second plurality of client devices for use with malware behavior monitoring programs, wherein the final exception list identifies processes that are to be excluded from monitoring acts by the malware behavior monitoring programs, wherein on a specific client device, a temporarily updated process list is replaced with the final process exception list.