Patent Document ID: 8171545
Application ID: 11674934
Patent Flag: 1

Claim One:
1. A computer implemented method for using statistical information concerning running processes to detect and manage process behavioral anomalies, the method comprising the steps of: granting, by a computer, an exclusion to a security policy for at least one process, such that the at least one process is allowed to perform activities on the computer which are blocked by the security policy for non-excluded processes; collecting statistical data concerning external interaction of the at least one process that was granted the exclusion to the security policy; analyzing at least some current collected statistical data against corresponding historical statistical data for the at least one process; responsive to results of the analyzing step, determining that the at least one process is behaving anomalously with respect to external interaction; and responsive to determining that the at least one process is behaving anomalously with respect to external interaction, revoking the exclusion to the security policy for the at least one process.