Patent ID: 7882508

Claim:
A method of information flow tracing, executed by at least a first computer, comprising: receiving at least one signature to trace; detecting a first process causing data to be provided to at least one of a second process and a file; determining whether the data contains the at least one signature; in response to determining that the data contains the at least one signature, updating a log with information associated with providing the data to at least one of the second process and the file, wherein the log contains information identifying at least one of processes and files that are part of an information flow containing the at least one signature, wherein the receiving, detecting, determining, and updating are part of the information flow tracing; during the information flow tracing, updating a first data structure to identify processes that have accessed data containing the at least one signature; during the information flow tracing, updating a second data structure to identify files that contain the at least one signature; and during the information flow tracing, updating offset maps that indicate locations in the identified files that contain the at least one signature.