Patent ID: 8370931

Claim:
A computer-implemented method of monitoring computer system behavior of a process, said method comprising: retrieving a policy having a plurality of rules and a within option for use in monitoring the behavior of a process in a computer wherein each of said rules identifies an event that may occur in said computer and said within option specifies a numeric value; capturing, by said computer, a first event occurring in said computer said first event being associated with said process; ascertaining whether said first event matches the first rule of said plurality of rules; capturing, by said computer, one or more additional events occurring in said computer each of said one or more additional events being associated with said process and occurring after said first event; capturing, by said computer, a second event occurring in said computer said second event being associated with, said process and occurring after said one or more additional events; ascertaining whether said second event matches a second rule of said plurality of rules; ascertaining whether a count of said one or more additional events is less than or equal to said numeric value; and identifying that the behavior of said process matches said policy when said first event matches said first rule, said second event matches said second rule, and the count of said one or more additional event is less than or equal to said numeric value said.