Patent ID: 7587724

Claim:
A method, comprising: monitoring on a processor incoming kernel mode calls; identifying a kernel mode call of the kernel mode calls to verify using a predetermined criterion; validating the identified kernel mode call in a kernel mode comprising: searching the kernel mode call for a security feature inserted by a user mode application programming interface interception application in a user mode, wherein the user mode application programming interface interception application inserts the security feature upon determining that the kernel mode call is clear of malicious code; and validating the kernel mode call if the security feature is found; processing the kernel mode call in accordance with results of the validation of the kernel mode call, wherein a user application in the user mode generates a system call into a user mode application programming interface in the user mode, wherein the user mode application programming interface processes the system call and generates the kernel mode call; intercepting the kernel mode call with the user mode application programming interface interception application; and inspecting the kernel mode call for the malicious code with the user mode application programming interface interception application in the user mode, wherein upon a determination that the kernel mode call comprises the malicious code, the method further comprising: terminating the kernel mode call with the user mode application programming interface interception application; and wherein upon the determining that the kernel mode call is clear of malicious code and after the security feature is inserted, the method further comprising: transferring the kernel mode call from the user mode application programming interface interception application to the kernel mode.