Patent ID: 7318163

Claim:
A method of detecting real-time system file intrusions in a user computer that is coupled to an administrator computer, said user computer comprising an operating system and a plurality of system files, said method comprising: receiving, by an application program interface (API) of the operating system at a boot time of the user computer, a list of vital system files of the plurality of system files as a protected set of system files, wherein the vital system files consists of a plurality of directory files, wherein each directory file comprises a name and location of a plurality of simple files, wherein the API is configured to synchronize file information displayed in computer windows of the user computer with the real files managed by the operating system, wherein the operating system comprises a kernel that cannot be modified after the boot time, wherein said declaring comprises storing the list of vital system files in a table in a kernel space within the kernel, and wherein the vital system files comprises the table and code that uses the table; launching at the boot time as many daemons as the total number of said directory files plus one such that each directory file is assigned to a unique daemon of said daemons for being monitored by the unique daemon, wherein said launching comprises: randomly choosing daemon names for said daemons such that an intruder cannot determine which daemon monitors each directory file, and programming the daemons to monitor one another for affirming that none of the daemons has been killed for a while; after said launching, detecting by the API a system call made to a first vital system file of the vital system files, wherein a first daemon of said daemons has been assigned for monitoring the first directory file; responsive to said detecting, raising an automatic interrupt ‘I’ command by the API in relation to the first vital system file; awakening, by the automatic interrupt ‘I’ command, a first daemon of said daemons that has been assigned for monitoring the first directory file, said first daemon being awakened from a sleep mode; catching the interrupt ‘I’ command by the first daemon upon being awakened; and after said catching the interrupt ‘I’ command, sending an alert message, from the first daemon to the administrator computer, to alert the administrator computer of said detecting the system call made to the first vital system file, followed by the first daemon returning to the sleep mode.