A method and system are directed to differentiating between normal characteristics and abnormal characteristics within a software process, such that tampering of the software process may be identified programmatically. The identification of behavior that may be defined as normal may vary. Such behavior...http://www.google.de/patents/US7594271?utm_source=gb-gplus-sharePatent US7594271 - Method and system for real-time tamper evidence gathering for software
