Patent ID: 7856661

Claim:
A method to be executed by a processor operating in an electronic environment for classifying software in a network system, comprising: (a) determining a software received by a sensor is attempting to execute on a computing system of the sensor; (b) classifying the software as authorized or unauthorized to execute on the computing system; (c) gathering information on the software by the sensor and sending the information to one or more actuators for analysis and generation of a directive for one or more targets, if the software is classified as unauthorized to execute, wherein the gathering step (c) comprises: (c1) preparing data about the execution attempt of the unauthorized software: (c2) collecting ancillary data relevant to the one or more actuators for the analyzing the execution attempt and for generating directives for the one or more targets; and (c3) sending the ancillary data to the one or more actuators, and wherein the ancillary data comprises: network packets which encoded the unauthorized software; source and destination IP addresses and ports indicating a network connection of the network packets which encoded the unauthorized software; a packet payload signature or a packet header signature; or a checksum of the unauthorized software.