Patent ID: 9665708
Date: 2017-05-30
CPC Classifications: G06F,H04L,Y10S

Claim:
1. A method comprising: intercepting, by a kernel-level driver within a kernel of an operating system of a computer system, activity in connection with a file system associated with the computer system or the operating system relating to a code module; determining, by the kernel-level driver, whether to allow the intercepted activity to proceed by performing a real-time authentication process of the code module with reference to a multi-level whitelist database architecture, wherein the multi-level whitelist database architecture includes: when the intercepted activity is allowed to proceed as a result of said determining, permitting, by the kernel-level driver, the code module to be loaded and executed by the computer system; and when the intercepted activity is not allowed to proceed as a result of said determining, preventing, by the kernel-level driver, the code module from being loaded and executed by the computer system.