METHOD OF DETECTING MALWARE IN OPERATING SYSTEM KERNEL Russian patent published in 2014 - IPC G06F21/56 G06F12/14 G06F11/00 

FIELD: information technology.

SUBSTANCE: method is realised on a computer with an operating system (OS) installed thereon, and involves establishing a point of interrupt when a system call is made by a user application requesting the transfer of control via an address in the kernel of the loaded OS, checking the data structure of the loaded OS by performing the following: determining the address of the instruction in the computer memory, which will be handed over control during a system call; checking affiliation addresses of commands executed during the system call to the normal range addresses the kernel and modules of operating system kernel in memory; detecting the presence of malicious software in the absence of affiliation of the instruction address to the normal range of addresses.

EFFECT: high efficiency of detecting malware by enabling detection of illegal interception and alteration of the code in the kernel and in the OS kernel modules that are to be loaded.