Patent ID: 8572050

Claim:
A method for managing integrity of system log file data, the method comprising: at system boot time, defining one or more log files; intercepting, using a hook in a kernel of an operating system, write operations by a file system to the at least one log file; upon each interception of a write operation to a respective one of the log files by the hook in the kernel of the operating system: extracting from a record of the log file to be written to by the write operation, a context of the write operation, the context including a process that created the log file or an identifier of a user that created the log file record; and comparing the context extracted in a current interception with the context extracted in a previous interception and stored in an opening token in the log file and, when the context has changed from the previous interception to the current interception, writing additional information in a closing token in the log file before allowing the write operation of the log file record to be written, the additional information in the closing token advising of a change in the context of the log file of the current interception; reading in the respective log file the additional information in the closing token advising of a change in the context of the log file of a writing interception and reading at least one log file record preceding the additional information to determine when it was a malicious writing; and, creating an output pointing out the malicious writing operations in the log file.