Granted Patent B1

US 8,291,494 · App. 12/169,420 · Granted Oct 16, 2012

Abstract

Claims (30)

1. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:

monitoring an operation performed by an object using an intrusion system;

labeling the object with an attribute of a predetermined behavior based on detection of the predetermined behavior in association with the object, the attribute including a uniform resource locator (URL) that is embedded into the object, and wherein the detection of the predetermined behavior includes matching a behavior associated with the object to a compound rule;

extracting a plurality of rules from the compound rule; and

extracting additional rules from the plurality of rules in iterations until each rule extracted has no further dependencies and a reaction to the object is resolved without storing an event associated with the object in a cache.

2. The computer program product of claim 1 , wherein the labeling includes flagging the object with the attribute.

3. The computer program product of claim 1 , wherein the object includes an executable program.

4. The computer program product of claim 1 , wherein the attribute includes a string value.

5. The computer program product of claim 1 , further comprising:

identifying a particular event associated with the object.

6. The computer program product of claim 5 , further comprising:

determining whether the particular event includes the predetermined behavior.

7. The computer program product of claim 5 , wherein parameters associated with the particular event are extracted.

8. The computer program product of claim 7 , wherein the parameters are stored.

9. The computer program product of claim 1 , wherein the object is associated with unwanted activity.

10. The computer program product of claim 9 , wherein the unwanted activity is detected by analyzing the attribute and a plurality of additional attributes with which the object is labeled.

11. The computer product of claim 9 , wherein the unwanted activity is detected by determining a value of the attribute.

12. The computer program product of claim 11 , wherein the value of the attribute indicates that at least a portion of the unwanted activity associated with the object has occurred.

13. A method, comprising:

monitoring an operation performed by an object using an intrusion system;

labeling the object with an attribute of a predetermined behavior based on detection of the predetermined behavior in association with the object, the attribute including a uniform resource locator (URL) that is embedded into the object, and wherein the detection of the predetermined behavior includes matching a behavior associated with the object to a compound rule;

extracting a plurality of rules from the compound rule in; and

extracting additional rules from the plurality of rules in iterations until each rule extracted has no further dependencies and a reaction to the object is resolved without storing an event associated with the object in a cache.

14. A system, comprising:

a processor coupled to a memory, the system being configured for:

monitoring an operation performed by an object using an intrusion system;

labeling the object with an attribute of a predetermined behavior based on detection of the predetermined behavior in association with the object, the attribute including a uniform resource locator (URL) that is embedded into the object, and wherein the detection of the predetermined behavior includes matching a behavior associated with the object to a compound rule;

extracting a plurality of rules from the compound rule; and

extracting additional rules from the plurality of rules in iterations until each rule extracted has no further dependencies and a reaction to the object is resolved without storing an event associated with the object in a cache.

15. The system of claim 14 , wherein the processor remains in communication with the memory and a network adapter via a bus.

Assignments (10)