Behavior-Blocking Software

• Monitors program behavior in real-time for malicious actions – part of OS

• Look for well defined requests to the OS: modifications to files, disk formats, mods to scripts or macros, changes in config settings, open network connections, etc.

• IPS – Intrusion Prevention Systems