Patent ID: 8732824

Claim:
A method for monitoring the integrity of a running host computer system, comprising: (a) coupling at least one monitor unit having a direct access to at least one monitored structure of a running host computer system and operating independently therefrom, said at least one monitored structure having at least two security relevant objects, including a first security relevant object and a second security relevant object, characterized by an invariant property associated therewith, wherein the invariant property includes a relationship between the first security relevant object and the second security relevant object; (b) creating a Test Model including at least one semantic predicate descriptive of said invariant property of said at least two security relevant objects of said at least one monitored structure known-to-be unviolated, wherein a semantic predicate comprises a description of the invariant property associated with the at least two security relevant objects and the description is independent of any stored data; (c) loading said Test Model into said at least one monitor unit to be executed therein; (d) acquiring a memory image of at least a portion of said at least one monitored structure of said at least one monitor unit; (e) decomposing, under said Test Model control, said acquired memory image to extract therefrom a representation of said at least two security relevant objects of the running host system; (f) verifying, by evaluating said invariant property associated with said at least two security relevant objects of the running host system; and (g) issuing a signal indicative of a violation of said invariant property of said at least one security relevant object of the running host system when a discrepancy from said invariant property has been detected.