Endgame, Inc.

Matthew D Spisak

Cody R Pierce

Kenneth D Fitch

The present disclosure relates to a system and method for monitoring system calls to an operating system kernel. A performance monitoring unit is used to monitor system calls and to gather information about each system call. The information is gathered upon interrupting the system call and can include system call type, parameters, and information about the calling thread/process, in order to determine whether the system call was generated by malicious software code. Potentially malicious software code is nullified by a malicious code counter-attack module.

Hardware-assisted system and method for detecting and analyzing system calls made to an operating system kernel

Hardware&#x2014;assisted system and method for detecting and analyzing system calls made to an operating system kernel

In one aspect of the embodiments, malicious instructions executed or to be executed by a processor in a computing device are identified and preventive action is taken in response to that detection, thereby preventing harm to the computing device and the user's data by the malicious instructions. In another aspect of the embodiments, a thread context monitor determines which thread are active within an operating system at any given time, which further enhances the ability to determine which thread contains malicious instructions.

Growing community of inventors

Columbus, OH, United States of America

Matthew D Spisak