Patent Document ID: 8621624
Application ID: 12332012
Patent Status: 1

Claim One:
1. An apparatus for preventing an anomaly of an application program executed in a computer, comprising: a hardware processor; a behavior profile database that stores a behavior profile for each application program installed in the computer, wherein the behavior profile comprises, for the each application program, information on behavior that is permitted to be executed by the respective application program in operation, and wherein the behavior comprises at least one of process generation, registry write, file write and network connection behavior; a behavior monitor that detects behavior of the application program in operation, wherein the behavior monitor detects only behavior of a selected application program based on a monitoring-target program database storing a predetermined list of monitoring-target application programs, and wherein the predetermined list is configured from a list of application program interface (API) functions; an anomaly detector that determines whether the detected behavior of the application program is an anomaly based on the behavior profile of the application program stored in the behavior profile database, wherein the anomaly is configured to be detected from at least a reliable application program, wherein the reliable application program is configured to be a program trusted by a user to be executed in the computer of the user, and wherein the anomaly is configured to determine that the detected behavior of the respective application program is different from the permitted behavior to be executed by the same respective application program; and an anomaly stopper that stops the behavior of the application program determined as the anomaly by the anomaly detector.