Loading patent…
AssigneeTrend Micro Incorporated
InventorsRares STEFAN, Blake Stanton SUTHERLAND
Estimating the term…
A method and apparatus for detecting data modification in a layered operating system is disclosed. Outbound content indicators at different layers are compared to detect potential outbound data modifications. Likewise, inbound content indicators at different layers are compared to detect potential inbound data modifications. Content indicators include checksum, cryptographic hash, signature, and fingerprint indicators. Embodiments of the present invention enable detection of data modifications across an operating system's kernel and user mode spaces, prevention of modified outbound data from reaching a network, prevention of modified input data from reaching a user application, and detection of malware and faults within an operating system.
A method of examining data within a computing device implementing an operating system configured in multiple layers to detect data modification, said computing device having multiple processors and memory segregated into kernel space and user space, the method comprising configuring said multiple processors to perform processes of:
A method of examining data within a computing device implementing an operating system configured in multiple layers to detect data modification, said computing device having multiple processors and memory segregated into kernel space and user space, the method comprising configuring said multiple processors to perform processes of:
Dependencies are inferred from the claim text.