Patent ID: 8028336

Claim:
A computer readable encoding comprising software instructions, which when executed perform a method, the method comprising: compiling a program comprising at least one disabled probe to obtain a compiled program; executing the compiled program comprising the at least one disabled probe, wherein the at least one disabled probe does not collect information; enabling the at least one disabled probe within the compiled program to obtain at least one enabled probe; executing the compiled program comprising the enabled probe; collecting, by the at least one enabled probe during the executing the compiled program comprising the enabled probe, information related to parameters passed across a user-code/kernel code boundary of a computer system executing the program; generating a first trace characteristic using at least a portion of the information, wherein the first trace characteristic comprises information about a kernel code state of at least two system calls; and detecting an intrusion indication for the computer system, by comparing the first trace characteristic to a second trace characteristic, wherein the computer readable encoding is embodied in at least one physical computer readable medium selected from a group consisting of a magnetic storage medium, an optical storage medium, a semiconductor storage medium, and an electronic storage medium.