Patent ID: 7950056

Claim:
A method of providing computer security, comprising: determining whether a network communication is from a trusted process based at least in part on identification data associated with the trusted process; determining, in the event that the network communication is from the trusted process, that the trusted process has undergone a change to a binary code associated with the trusted process; allowing the trusted process to continue to engage in a network behavior subsequent to the change that the trusted process engaged in prior to the change, without first prompting a user to provide an input indicating whether the trusted process should be allowed to continue to engage in the network behavior subsequent to the change based at least in part on information stored in a network behavior repository; receiving, subsequent to the change, an attempt by the trusted process to engage in a new network behavior that was not associated with the trusted process prior to the change; prompting, based on the received attempt, a user to provide an indication whether the trusted process is to be allowed to engage in the new network behavior, wherein the prompt allows a user to specify options indicating an extent to which the trusted process is to be allowed to engage in the new network behavior, wherein the options include a type of network behavior that includes the new network behavior, wherein the user is not prompted if a change to the binary code associated with the trusted process has not been detected; denying engagement in the new network behavior, in the event that an indication to deny engagement in the new network behavior is received from the user, while allowing the trusted process to continue; and logging the new network behavior, in the event that an indication to allow engagement in the new network behavior is received, to include the logged information in the network behavior repository; wherein the type of network behavior comprises communicating via a port over which the trusted process was not observed to communicate prior to the change, communicating using a protocol by which the trusted process was not observed to communicate prior to the change, and communicating with a remote host with which the trusted process was observed to communicate prior to the change but in a different direction than the previously observed communication.