Patent ID: 8413135

Claim:
A computer-implemented method of controlling an installation of a software application on a device, the method being performed by at least one processor and comprising: detecting the installation of the software application on the device based on changes in a registry of the device; pausing the installation; collecting information about the installation including name of the software application, version of the software application, source of the software application, installer of the software application, and logged network communications between the device and other devices; assessing a danger level of the software application based upon the collected information, comprising comparing how similar the software application is to known types of dangerous applications which include viruses, spyware, and malware, determining whether the software application is using a stealth communication method to install on the device, and determining whether the device has previously communicated with a suspicious web site; and allowing the installation of the software application to continue if the danger level is below a threshold level and stopping the installation of the software application if the danger level is above the threshold level.