Protecting user mode processes from improper tampering or termination
AssigneeMicrosoft Corporation
InventorsEli Zeitlin, Arnon Axelrod, Anil Francis Thomas, Kanwaljit Marok
Life of this patent
Estimating the term…
Abstract
In one embodiment, a malware protection system may protect a computing system from a malware event. A data storage device 150 may store a watchdog filter driver 240 integrated with an operating system kernel 210. A processor 120 may intercept a process access to an application process 220 with the watchdog filter driver 240 to detect a malware event. The processor 120 may use the watchdog filter driver 240 to determine an originating process for the malware event.
Claims20
A machine-implemented method for malware protection of a computing device, comprising:
- executing a watchdog filter driver integrated with an operating system kernel;
- intercepting an open handle request to an application process with the watchdog filter driver to detect a malware event;
- determining with the watchdog filter driver an originating process for the malware event;
- filtering an open handle to remove a process access for the originating process;
- and
- detecting if the application process terminates.
A tangible machine-readable storage medium having a set of instructions detailing a method stored thereon that when executed by one or more processors cause the one or more processors to perform the method, the method comprising:
- intercepting an open handle request to an application process with a watchdog filter driver to detect a malware event;
- determining an originating process for the malware event with the watchdog filter;
- filtering an open handle to remove a process access for the originating process;
- and
- detecting if the application process terminates.
A malware protection system for a computing device, comprising:
- a data storage device to store a watchdog filter driver integrated with an operating system kernel;
- and
- a processor to intercept an open handle request to an application process with the watchdog filter driver to detect a malware event, determine an originating process for the malware event with the watchdog filter driver, filtering an open handle to remove a process access for the originating process;
- and detects if the application process terminates.
Dependencies are inferred from the claim text.