Patent ID: 11874920
Assignee: ACRONIS INTERNATIONAL GMBH
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 7:
8. A system of a device for preventing insertions of malicious processes, comprising:
a memory;
a hardware processor communicatively coupled with the memory and configured to execute an operating system (OS) operable in a user mode and a kernel mode; and
a filter driver of the kernel mode, executed by the hardware processor, configured to:
monitor active processes that are running in suspended mode; and
for each active process of the monitored active processes:
inject a dynamic link library (DLL) into the active process to hook an application programming interface (API) of an application corresponding to the active process, wherein the DLL is injected for tracking commands for suspension and resumption of the active process;
monitor file inputs and outputs of the application for anomalies while the active process is in the suspended mode;
when a command for resuming the active process is detected using the DLL, determine, based on the monitoring, whether a malicious process is inserted into the active process; and
allow the suspended process to resume execution in response to determining that no malicious process is inserted in the active process.