System and method for detecting keyboard logging
AssigneeInternational Business Machines Corporation
InventorsJoseph Garvey, Kevin Himberger, Clark Jeffries, Mohammad Peyravian
Life of this patent
Estimating the term…
Abstract
A kernel based detection of keyboard logger applications is achieved by configuring a call interface to the kernel to characterize a system call pattern for processes accessing a keyboard. A monitor thread iteratively examines a plurality of threads to test open( ), read( ), write( ), and syscall( ) system routines for conditions indicative of presence of a keyboard logger application. A thread whose system call pattern is characterized by such conditions is marked as a keyboard logger.
Claims10
A method for detection of keyboard logger applications, comprising:
- configuring a call interface to identify a system call pattern for processes accessing a keyboard;
- executing a monitor thread iteratively to examine a plurality of threads to test system routines selectively including open( ), read( ), write( ), syscall( ) or other data input/output system routines for conditions indicative of presence of a keyboard logger application, and
- characterizing as a possible keyboard logger a process that meets one or more of said conditions.
A computer program product for detecting keyboard logger, said computer program product comprising:
- a computer readable medium;
- first program instructions to identify a system call pattern for thread accessing a keyboard;
- second program instructions to iteratively examine a plurality of said threads to test status generated by open( ), read( ), write( ), and syscall( ) and other data input/output system routines for conditions indicative of presence of a keyboard logger application,
- third program instructions to characterize as a possible keyboard logger a thread whose system routine pattern is characterized by said condition;
- and wherein
- said first, second and third program instructions are recorded on said medium.
A system for kernel based detection of keyboard logger applications, comprising:
- a call interface to said kernel configured for characterizing a system call pattern for processes accessing a keyboard;
- a monitor thread for iteratively examining a plurality of said threads to test open( ), read( ), write( ), and syscall( ), or other data input/output system routines for a conditions indicative of presence of a keyboard logger application, and
- indicators for marking as a possible keyboard logger a thread whose system call pattern is characterized by said condition.
Dependencies are inferred from the claim text.