Patent ID: 8443354

Claim:
A method of computer security, comprising: receiving an indication that a prior version of an executable file has been replaced by a new version, the indication being received from a process executing code other than the executable file; receiving an identification of a new or changed portion of code comprising the new version, wherein the identification is determined based at least in part upon comparing a flow graph of the new version to a flow graph of the prior version of the executable file; and providing, using a computer processor, a security response if an indication is received that a process associated with the executable file is attempting to perform a user configurable restricted action and the new or changed portion of code comprising the new version has executed, wherein the user configurable restricted action is one of a set of possible actions that may be attempted by the executable file for which a user has configured the process executing code other than the executable file to trigger the security response when the executable file attempts at least one action from the set of possible actions.