Patent ID: 8566943

Claim:
A method for asynchronous processing of events on a computer system, the method comprising: (a) detecting a system call on the computer system; (b) filtering the system call to determine when the system call matches a security criteria; (c) creating a copy of the system call and asynchronously processing the system call copy, if the system call does not pass through at least one filter, and at least one of the filter security criteria does not match the system call; (d) placing the system call into a queue for processing; (e) releasing the system call by performing further processing on the event copy; (f) deleting the system call copy from the queue; (g) processing the system call copy, wherein the processing of the system call copy comprises anti-virus (AV) checking of the system call copy and terminating an object that caused the system call, when the AV check reveals a malicious nature of the system call; and (h) for an object associated with the system call that has behavior differences compared to a previous known non-malicious version of the object but also similarities to the previous known non-malicious object, classifying the object as non-malicious, wherein steps (b)-(h) are performed sequentially on the computer system without interrupting execution of the system call on the computer system.