Patent ID: 7895448

Claim:
A method for providing computer security, comprising: determining, using at least one computer processor, whether an executable associated with a static state meets one or more first predetermined criteria, the determination not requiring a known executable, other than the executable associated with the static state, or analysis of behavior of the executable and including a determination of at least one of: whether the executable is configured as a service and whether the executable is configured to run under a highly privileged account; associating a first risk level with the executable based at least in part upon whether the executable meets the one or more first predetermined criteria; determining whether a current process associated with the executable meets one or more second predetermined criteria; associating a second risk level with the current process based at least in part upon whether the current process meets the one or more second predetermined criteria, wherein the current process is initially associated with the first risk level, and wherein the first risk level is updated to the second risk level for the current process based at least in part upon whether the current process meets the one or more second predetermined criteria; and performing a predetermined responsive action with respect to the process if the second risk level exceeds a threat detection threshold; wherein determining whether the executable meets the one or more first predetermined criteria does not comprise comparing the executable with a virus signature.