A system for securing an electronic device, comprising: a processor; a memory communicatively coupled to the processor; and an anti-malware module communicatively coupled to the processor and configured to: determine addresses of one or more memory pages, which are designated as protected memory pages, in the memory; for each protected memory page, inject a portion of identifier data into the protected memory page; store, in a lookup table referenced by the address of each of the protected memory pages, an indication of the identifier data injected into each of the protected memory pages; determine an attempt to access at least one of the protected memory pages; determine any of the identifier data present on a protected memory page associated with the attempt; compare the stored indication of the identifier data with the determined identifier data present on the memory page, and if the stored indication of the identifier data differs from the determined identifier data, determine that a linear address mapping of the address of the protected memory page into physical memory of the system has been tampered with by malware; and based on the comparison, determine whether to allow the access. a processor; a memory communicatively coupled to the processor; and an anti-malware module communicatively coupled to the processor and configured to: determine addresses of one or more memory pages, which are designated as protected memory pages, in the memory; for each protected memory page, inject a portion of identifier data into the protected memory page; store, in a lookup table referenced by the address of each of the protected memory pages, an indication of the identifier data injected into each of the protected memory pages; determine an attempt to access at least one of the protected memory pages; determine any of the identifier data present on a protected memory page associated with the attempt; compare the stored indication of the identifier data with the determined identifier data present on the memory page, and if the stored indication of the identifier data differs from the determined identifier data, determine that a linear address mapping of the address of the protected memory page into physical memory of the system has been tampered with by malware; and based on the comparison, determine whether to allow the access. determine addresses of one or more memory pages, which are designated as protected memory pages, in the memory; for each protected memory page, inject a portion of identifier data into the protected memory page; store, in a lookup table referenced by the address of each of the protected memory pages, an indication of the identifier data injected into each of the protected memory pages; determine an attempt to access at least one of the protected memory pages; determine any of the identifier data present on a protected memory page associated with the attempt; compare the stored indication of the identifier data with the determined identifier data present on the memory page, and if the stored indication of the identifier data differs from the determined identifier data, determine that a linear address mapping of the address of the protected memory page into physical memory of the system has been tampered with by malware; and based on the comparison, determine whether to allow the access.