Patent ID: 9747447
Date: 2017-08-29
CPC Classifications: G06F

Claim:
1. A method of detecting the possible presence of malware operating on a monitored computer system, the method comprising: accessing a copy of an executable program file, the executable program file containing the compiled code of a program for execution on the monitored system, as stored on a persistent storage device of the monitored system and calculating in respect thereof expected absolute values for memory locations of functions or helper programs identified for possible calling by the executable program file, which functions or helper programs are intended to be linked in a dynamic manner only at load or run time of the program, accessing values of corresponding memory locations contained within the executable program file once loaded into memory, and comparing the accessed values with the corresponding calculated expected values and determining the possible presence of malware on the monitored system where the comparison indicates that at least one pair of an accessed value and a corresponding calculated expected value do not match.