Patent ID: 8171547

Claim:
A method for real time classification of change events in a computing system, comprising one or more client operational computers, the method comprising: (a1) providing a known secure computer free from inbound connections from other computer systems, including installing an operating system and software application programs on the known secure computer, which are identical to the operating system and the software application programs running on the client operational computers; (b1) at the known secure computer: (b1-i) visiting trusted hosts and checking for availability of software update for one or more client operational computers; (b1-ii) performing the software update in advance of the client operational computers; (b1-iii) generating change events at the known secure computer in response to the software update; (c1) at each client operational computer, generating change events resulting from the software update performed on the client operational computer; (e1) comparing the change events at the known secure computer with respective change events generated at each said client operational computer; and (f1) generating an alert for the change event, provided the change event at the known secure computer and the change event generated at the client operational computer differ.