Abstract: Embodiments provide process monitoring. One such embodiment begins by receiving a system call associated with a process. In turn, in a modified system call table of an operating system, such an embodiment identifies (i) a modified handler corresponding to the received system call and (ii) an original handler corresponding to the received system call. Next, in parallel, validity of the process is analyzed using the modified handler and the system call and the system call is serviced using the original handler. The servicing of the system call is maintained or stopped based on the analyzing.

Abstract: In some embodiments, a method includes determining whether a request to a web-based application running at a server is potentially harmful by inspecting the request and interpretations of the request by the web-based application. If the request of the web-based application is potentially harmful, the method issues a protection action to the web-based application. The protection action can be a mitigation measure such as stopping the request from being run at the user system, stopping the user request from being run in the server, denying the user request from read access to a database, and/or denying the user request from write access to a database.