Patent ID: 7620983

Claim:
A method of providing security, comprising: accessing a prefetch file configured to store operational information comprising an identification of one or more resources accessed by a process during initialization of the process, which prefetch file an operating system with which the process is associated, or a component or module of the operating system, is configured to use in the event of a subsequent initialization of the process to prefetch at least one of said one or more resources prior to access to said at least one of said one or more resources being requested by the process; determining a first behavior using the operational information, wherein the first behavior is associated with the process; monitoring the process; comparing a second behavior with the first behavior, wherein the second behavior is attempted by the process; and performing a predetermined responsive action if the second behavior is different from the first behavior; wherein determining the first behavior includes parsing the prefetch file to identify the one or more resources and wherein the second behavior is determined to be different from the first behavior if the second behavior comprises an attempt by the process to access a resource not included in the one or more resources; and further comprising monitoring the prefetch file for changes to the prefetch file and in the event a change to the prefetch file is detected reparsing the prefetch file to determine whether any new resource in addition to the one or more resources is included in the prefetch file as changed and, in the event any such new resource is included in the prefetch file as changed determining a third behavior associated with the process, which third behavior comprises accessing said new resource and which third behavior is considered to be an authorized behavior of the process.