Patent ID: 8646080

Claim:
A method of protection from harmful software on a computer, comprising: using a graph rule processor, tracking a set of one or more relationships based upon the occurrence of one or more events among a plurality of nodes, the plurality of nodes representing: a set of one or more processes on the computer and a set of one or more files on the computer, wherein the set of one or more relationships includes: a first subset of one or more relationships among at least one process of the set of one or more processes and at least one file of the set of one or more files, wherein said first subset of one or more relationships excludes instance of-type relationships; modifying a set of one or more characteristics based upon the set of one or more relationships; tracking the set of one or more characteristics at each node of the plurality of nodes, wherein the set of one or more characteristics is passed around a graph; based at least on a change in the set of characteristics, classifying as to be cleaned, at the computer, at least one node of the plurality of nodes; comparing the at least one node to be cleaned against a plurality of rules, each of the plurality of rules comprising a condition and an action for each relationship; based upon the comparison of the at least one node to be cleaned, classifying the at least one node to be cleaned as change and placing the node in a node change queue for processing by the graph rule processor; determining a score for the at least one changed node, wherein the score is based upon one or more potentially malicious actions the at least one changed node has performed; if the determined score satisfies a score trigger, classifying the at least one changed node as harmful software; and removing, at runtime, effects of the harmful software from the computer.