US 7047369 B1 The invention contains an application operating
environment in which acceptable and/or suspect activities may be
defined for an application so that unacceptable application
behavior can be prevented. This is done by providing a
definition table identifying the types of access and actions
that the application is allowed and preventing it from carrying
out other types of access and actions. The definition table may
be built up using a learning process during use of the
application. The environment also provides a means of checking
information output to a network against a list of confidential
information. 1. Apparatus for ensuring the integrity of an
application executed on a computer having data storage arranged
sectorwise, comprising: apparatus for learning about permitted
access behavior of said application to said data storage
arranged sectorwise by monitoring accesses of said application
to sectors of said data storage during a limited learning period
in which said application is assumed to b