Patent ID: 8230509

Claim:
A method for preventing a malicious or unwanted software function from acting upon an object within a computer system, the method being executed by one or more processors configured to perform a plurality of operations comprising: determining a rule from a plurality of pre-existing rules that applies to an object within a computer system, wherein each of the plurality of pre-existing rules is associated with a plurality of characteristics including: a platform indicator that specifies a type of platform on which an object to which the rule applies operates, an object type indicator that specifies a type of object to which the rule applies, an object indicator that specifies a specific object to which the rule applies, and a function type indicator that specifies a function type that triggers an action with regard to the object, and wherein determining a rule that applies to the object includes determining a rule from the plurality of pre-existing rules that includes: a platform indicator that matches a platform on which the object operates, an object type indicator that matches an object type of the object, and an object indicator that matches the object; associating object attributes with the object according to the rule, wherein the object attributes include a function type of the function type indicator and a classification that indicates a specific action to be performed with regard to the object; detecting a software function attempting to act upon the object; determining whether the detected software function matches the function type of the object attributes; and performing the specific action when the detected software function matches the function type of the object attributes, wherein the specific of action relates to whether the detected software function will be allowed to act upon the object, and wherein the specific action performed is determined using the classification of the object attributes.