Patent Document ID: 20060143707
Application ID: 11166691
Patent Flag: 0

Claim One:
1. A detection method of malicious codes, applicable to a computer system, said computer system having at least a host, each said host executing at least an application program, and each said application program comprising at least a process; said method comprising the steps of: (a) intercepting all the system calls and related arguments from all said processes by a pre-installed system call monitor module on each said host; (b) extracting a plurality of pre-defined system calls from all the intercepted system calls by a malicious code analysis module; (c) determining whether said intercepted pre-defined system calls, arguments, and input data flow being suspicious of including malicious codes; if not, returning to step (a); (d) executing said suspicious malicious code and generating a behavior prediction of the suspicious malicious code; (e) comparing said predicted behavior with the actual behavior of the execution of said suspicious malicious code; if different, returning to step (a); and (f) issuing a warning of intrusion.