Abstract: The invention relates to computer security, and specifically to a method and system for defining the profile of expected application behaviors. According to one aspect, multiple application behavioral metric definitions are expressed for expected application interactions and state on a temporal basis. At least some of the behavioral definition metrics are expressed based on an association with an application profile or common entity. The expressed application profile definitions (APDs) are utilized to evaluate whether actual behavioral conditions specified by application profile white lists, policies and or security policies associated with the common entity have been satisfied. APDs are a defined set of metrics that can be expressed using the APD creator wizard or express using XLM, Json or any other software definition format. Responsive to evaluating that a APD behavioral condition has been deviated, an alert is generated and communicated to one or more response devices associated with the common entity.

Abstract: The invention relates to computer security, and specifically to a method and system for creating and storing a time-based graph of all application behaviors in an enterprise or organization. For example, according to one aspect, multiple application behavioral metric definitions are expressed for expected application interactions and state on a temporal basis, these metrics are each part of a behavior that needs to be evaluated individually or in combination with other metrics. At least some of the behavioral metrics are expressed based on an association with an application profile or common entity. The Temporal Profile Graph make associating and lookup of application behaviors efficient and cheap on compute and memory requirements. The graph node relationship is built using a time-based key that enables quick association of all application behavior metrics to a specific period in time within the enterprise or organization operating environment.

Abstract: Methods, computer readable media, and apparatuses for real-time application state monitoring, white list profile instantiation, behavioral detection and automatic cyber-attack defense are presented. For example, according to one aspect, multiple application behavioral metrics are received from multiple behavioral metric collection agents. At least some of the behavioral metrics are identified based on an association with an application profile or common entity. The identified behavioral metrics are utilized to evaluate whether behavioral conditions specified by application white lists, policies and or security policies associated with the common entity have been satisfied. Responsive to evaluating that a behavioral condition has been deviated, an alert is generated and communicated to one or more response devices associated with the common entity.