Patent ID: 7832005

Claim:
A method for detecting deviations from normal behavior in a processing system comprising: starting a first learning phase for a first process associated with an application running on the processing system based on a first start criteria associated with the first process; learning, by a computer of the processing system, during the first learning phase, normal behavior associated with the first process; starting a second learning phase for a second process associated with the application; stopping the first learning phase, by the computer of the processing system, based on a first stop criteria associated with the first process and without regard to whether a second stop criteria associated with the second process is satisfied; starting a first protect phase for the first process running on the processing system based at least in part on completion of the first learning phase for the first process, wherein the first protect phase is configured to start prior to the completion of the second learning phase; stopping the second learning phase; and starting a second protect phase for the second process wherein the second protect phase initiation is independent of the first protect phase initiation and the second protect phase controls behavior of the second process independently of the first protect phase.