Patent Document ID: 8176555
Application ID: 12130812

Base Claim:
1. A computer-implemented method for detecting malicious processes based at least in part on an analysis of process names, the method comprising: identifying a process; identifying a process name for the process; identifying a list of known non-malicious processes, wherein the list of known non-malicious processes identifies, for each non-malicious process within the list, at least one of: at least one process name associated with the non-malicious process; at least one acceptable file location from which the non-malicious process may execute; determining, at least in part by comparing the process name for the process with the list of known non-malicious processes, that the process represents an attempt to mimic a process name of at least one known non-malicious process; determining, based on the determination that the process represents an attempt to mimic the process name of at least one known non-malicious process, that the process represents a security risk; preventing the process from executing; wherein at least a portion of the method is performed by a computing device comprising at least one processor.

---

Claim 2:
2. The method of claim 1 , wherein the list of known non-malicious processes is maintained on a client-side computing system.