Patent ID: 8925101

Claim:
A method comprising: intercepting, on a computing device, one or more packets of an outbound network access attempt initiated by a process executing on the computing device, wherein the packets include a requested destination address in a network; determining the process mapped to the packets; querying a process traffic mapping element of the computing device to determine each software program file of a plurality of software program files mapped to the process in the process traffic mapping element, wherein at least one software program file of the plurality of software program files is an executable file and at least one other software program file of the plurality of software program files is a library module loaded by the process; determining a trust status of each software program file of the plurality of software program files; determining whether the network access attempt is permitted based on at least a first criterion, wherein the first criterion includes the trust status of each software program file of the plurality of software program files; and blocking the network access attempt on the computing device if the network access attempt is not permitted.