Patent ID: 8495743

Claim:
A method comprising: inserting at least one notifying identifier in a computer system, the at least one notifying identifier providing execution information associated with the computer system; receiving execution information from the at least one notifying identifier, the execution information identifying details associated with a traffic flow comprising a plurality of data payloads on the computer system; and identifying a collection of sub strings from some of the plurality of data payloads on the at least one computer system; assigning a probability to each of the sub strings within the collection of sub strings; and associating the probability to a likelihood that a data payload associated with each of the sub strings is one of the group consisting of a good data payload and a bad data payload; receiving notification that a policy violation has been triggered for at least one attack on the computer system; in response to the notification, deterministically identifying, from the execution information provided by the at least one notifying identifier, a data payload that is associated with the at least one attack; in response to deterministically identifying, from the execution information provided by the at least one notifying identifier, the data payload that is associated with the at least one attack, generating a signature that matches at least a first portion of the data payload; refining the signature utilizing the traffic flow on the computer system to create an optimal signature by removing elements of the signature that are matched to good data payloads; utilizing the optimal signature to filter out data processed by the computer system by preventing processing of a second data payload within the computer system; wherein the method is performed by one or more computing devices.