Patent ID: 7631356

Claim:
A method of detecting an attempt to execute foreign code, comprising: identifying a page of memory that contains code, based on a standard as to the likelihood that the code contained in the page will be executed, wherein the standard is a page fault history that identifies the page as being paged-in to physical memory and calling code invoking the page to be paged-in; verifying that the code satisfies an integrity test; taking at least one action to prevent the code from executing, if the code does not satisfy the integrity test, wherein: identifying the page comprises reviewing the page fault history, the page fault history being a record of each page paged into the physical memory and also the calling code which requested the paged-in page, to identify the paged-in page and the calling code thereof, verifying the code comprises applying the integrity test to the code contained in the paged-in page, and also to the calling code which requested the paged-in page, and applying the integrity test comprises determining that the calling code is not foreign code that is not intended to reside in the physical memory, and examining computer system event handler functions and pointers to the event handler functions for foreign code, each event handler function being executed in response to an event arising from at least one of user actions or system occurrences, the examining of each event handler function comprising: examining each pointer pointing to the event handler function to determine that the pointer in fact points to the event handler function and not elsewhere; examining for any infiltration by foreign code of the event handler function; and examining the event handler function for any modification thereof referring to foreign code.