Method and system for protecting against malicious mobile code

A method for protecting a host computer from malicious mobile code, the host computer including an operating system and at least one local resource controlled thereby, the method comprising:

• identifying mobile code received by the host computer;
• inserting at least one jump command within the operating system for monitoring access of the at least one local resource by the mobile code;
• transferring control of the at least one local resource to a protective program via the at least one jump command if the mobile code calls the at least one local resource;
• and
• blocking access to the at least one local resource by the mobile code if the mobile code is malicious.

A method for protecting a host computer from malicious mobile code, the host computer including an operating system and at least one local resource controlled thereby, the method comprising:

• identifying mobile code received by the host computer;
• monitoring access of the at least one local resource by the mobile code;
• and
• using a protective program to determine whether the mobile code is potentially malicious, and if so, then
• allowing the mobile code to access the at least one local resource, and
• recording changes made to the host computer.

A machine readable medium having machine readable instructions stored thereon for causing a host computer to perform the steps of:

• identifying mobile code received by the host computer;
• modifying an operating system of the host computer for monitoring access of the at least one local resource by the mobile code;
• transferring control of at least one local resource within the host computer to a protective program if the mobile code calls the at least one local resource;
• and
• determining whether the mobile code is malicious.

A machine readable medium having machine readable instructions stored thereon for causing a host computer to perform the steps of:

• identifying mobile code received by the host computer;
• monitoring access of the at least one local resource by the mobile code;
• and
• using a protective program to determine whether the mobile code is potentially malicious, and if so, then
• allowing the mobile code to access the at least one local resource, and
• recording changes made to the host computer.

A computer system comprising:

• a processor having an operating system associated therewith;
• at least one local resource controlled by the operating system;
• and
• a memory connected to said processor and having stored therein a protective program for protecting said at least one local resource from a malicious mobile code, the protective program for
• identifying mobile code received by the processor,
• modifying the operating system for monitoring access of the at least one local resource by the mobile code,
• transferring control of said at least one local resource to the protective program if the mobile code calls the at least one local resource, and
• determining whether the mobile code is malicious.

A computer system comprising:

• a processor having an operating system associated therewith;
• at least one local resource controlled by the operating system;
• and
• a memory connected to said processor and having stored therein a protective program for protecting said at least one local resource from a malicious mobile code, the protective program for
• identifying mobile code received by the processor,
• monitoring access of the at least one local resource by the mobile code, and
• determining whether the mobile code is potentially malicious, and if so, then
• allowing the mobile code to access said at least one local resource, and
• recording changes made thereto.