SIGNATURE-BASED DETECTION OF KERNEL DATA STRUCTURE MODIFICATION

A method and apparatus for signature-based detection of kernel data structure modification are disclosed. In the method and apparatus a signature is generated for a kernel data structure, whereby the kernel data structure is capable of being modified based at least in part on access to the kernel data structure. The signature is also updated as a result of access to the kernel data structure due at least in part to one or more identified instructions being executed. The signature is used to determine whether the kernel data structure is accessed by one or more other instructions.