1. A method of protection from harmful software on a computer, comprising: tracking a set of one or more relationships among a plurality of nodes, the plurality of nodes representing: a set of one or more processes on the computer and a set of one or more files on the computer, wherein the set of one or more relationships includes: a first subset of one or more relationships among at least one process of the set of one or more processes and at least one file of the set of one or more files, wherein said first subset of one or more relationships excludes instance of-type relationships; tracking a set of one or more characteristics at each node of the plurality of nodes; based at least on the set of one or more characteristics, classifying as harmful software, at the computer, at least one node of the plurality of nodes; and removing, at runtime, effects of the harmful software from the computer.