Malicious Direct Syscall Call Detection

A security server, comprising:

• a memory;
• and
• a processor configured:
• to deploy, in the memory, a hooked version of a syscall used by an operating system kernel of a computer,
• to receive, from the computer, a notification of a call to a hooked version of the syscall from a user mode of the second computer, the notification comprising a return address in the memory and a set of features extracted from the call,
• to analyze the return address and the received features so as to classify the call as benign or malicious, and
• to generate, for the computer, an alert upon classifying the new call as malicious.

A computer software product for protecting a computer, the computer software product comprising a non-transitory computer-readable medium, in which program instructions are stored, which instructions, when read by the computer, cause the computer:

• to deploy in a memory of the computer a hooked version of a syscall used by an operating system kernel of the computer;
• to receive, from the hooked version of the syscall, a notification of a call to the hooked version of the syscall from a user mode of the computer, the notification comprising a return address in the memory and a set of features extracted from the call;
• to analyze the return address and the received features so as to classify the call as benign or malicious;
• and
• to generate, for the computer, an alert upon classifying the new call as malicious.