Abstract: Disclosed are systems and method for controlling access to objects of an operating system using Access Control Lists (ACLs). An exemplary method comprises: generating, by a processor, one or more ACLs for objects of the operating system based on at least one access rule specifying the access mode to the object of the operating system to one or more users based on the one or more categories to which the objects belongs; intercepting a request from a user to access an object of the operating system; determining, by the processor, one or more ACLs associated with the requested object; and applying, by the processor, the determined one or more ACLs to decide whether to allow or deny access of the user to the requested object, wherein if one of the applied ACLs denies access to the object, the access will be blocked, otherwise the access will be allowed.

Abstract: Disclosed are systems and methods for blocking access to protected applications. An exemplary method includes: intercepting access by a process of first information to be displayed on the user's device; determining second information based on the interception of the access by the process, the second information associated with the process; determining a region on a display of the user's device associated with the first information; analyzing one or more intersections between the region and at least one graphic interface associated with the process; and blocking the access by the process to the first information based on the analysis of the one or more intersections between the region and the at least one graphic interface associated with the process.

Abstract: Disclosed are systems and method for controlling access to objects of an operating system using Access Control Lists (ACLs). An exemplary method comprises: generating, by a processor, one or more ACLs for objects of the operating system based on at least one access rule specifying the access mode to the object of the operating system to one or more users based on the one or more categories to which the objects belongs; intercepting a request from a user to access an object of the operating system; determining, by the processor, one or more ACLs associated with the requested object; and applying, by the processor, the determined one or more ACLs to decide whether to allow or deny access of the user to the requested object, wherein if one of the applied ACLs denies access to the object, the access will be blocked, otherwise the access will be allowed.

Abstract: Disclosed are systems and methods for blocking access to protected applications. An exemplary method includes: intercepting access by a process of first information to be displayed on the user's device; determining second information based on the interception of the access by the process, the second information associated with the process; determining a region on a display of the user's device associated with the first information; analyzing one or more intersections between the region and at least one graphic interface associated with the process; and blocking the access by the process to the first information based on the analysis of the one or more intersections between the region and the at least one graphic interface associated with the process.

Abstract: Systems and methods for intercepting computing device system calls for a computing device including a kernel having a system call table. A hypervisor is executed on the computing device, the hypervisor configured to control at least one of the computing device processor registers. At least one modified kernel structure is created, the modified kernel structure including a modified system call table. A memory address of an original system call handler is determined, the original system call handler configured to receive kernel operation commands. A size of a loaded image of the original system call handler is determined. A copy of the original system call handler as a second system call handler is created, and the second system call handler intercepts a computing device system call.

Abstract: Systems and methods for intercepting computing device system calls for a computing device including a kernel having a system call table. A hypervisor is executed on the computing device, the hypervisor configured to control at least one of the computing device processor registers. At least one modified kernel structure is created, the modified kernel structure including a modified system call table. A memory address of an original system call handler is determined, the original system call handler configured to receive kernel operation commands. A size of a loaded image of the original system call handler is determined. A copy of the original system call handler as a second system call handler is created, and the second system call handler intercepts a computing device system call.

Abstract: Systems and methods for intercepting computing device system calls for a computing device including a kernel having a system call table. A hypervisor is executed on the computing device, the hypervisor configured to control at least one of the computing device processor registers. At least one modified kernel structure is created, the modified kernel structure including a modified system call table. A memory address of an original system call handler is determined, the original system call handler configured to receive kernel operation commands. A size of a loaded image of the original system call handler is determined. A copy of the original system call handler as a second system call handler is created, and the second system call handler intercepts a computing device system call.

Abstract: An initial trust status is assigned to a first object, the trust status representing one of either a relatively higher trust level or a relatively lower trust level. Based on the trust status, the first object is associated with an event type to be monitored, where the event type is selected from among: essential events, occurrence of which is informative as to trust status evaluating for an object, and critical events, including the essential events, and additional events, occurrence of which is informative as to execution of suspicious code. Occurrences of events relating to the first object are monitored. In response to the first object being assigned the relatively higher trust level, only the essential events are monitored. In response to the first object being assigned the relatively lower trust level, the critical events are monitored. A need for performing malware analysis is determined based on the trust status of the first object and the event type.

Abstract: An initial trust status is assigned to a first object, the trust status representing one of either a relatively higher trust level or a relatively lower trust level. Based on the trust status, the first object is associated with an event type to be monitored, where the event type is selected from among: essential events, occurrence of which is informative as to trust status evaluating for an object, and critical events, including the essential events, and additional events, occurrence of which is informative as to execution of suspicious code. Occurrences of events relating to the first object are monitored. In response to the first object being assigned the relatively higher trust level, only the essential events are monitored. In response to the first object being assigned the relatively lower trust level, the critical events are monitored. A need for performing malware analysis is determined based on the trust status of the first object and the event type.

Abstract: An initial trust status is assigned to a first object, the trust status representing one of either a relatively higher trust level or a relatively lower trust level. Based on the trust status, the first object is associated with an event type to be monitored, where the event type is selected from among: essential events, occurrence of which is informative as to trust status evaluating for an object, and critical events, including the essential events, and additional events, occurrence of which is informative as to execution of suspicious code. Occurrences of events relating to the first object are monitored. In response to the first object being assigned the relatively higher trust level, only the essential events are monitored. In response to the first object being assigned the relatively lower trust level, the critical events are monitored. A need for performing malware analysis is determined based on the trust status of the first object and the event type.

Abstract: Disclosed are systems, methods and computer program products for control of applications using preliminary file filtering. An example method includes intercepting, by a processor, an operation on a file performed by an application; selecting at least a part of the file; applying one or more file filters to the selected part of the file; determining a set of file characteristics based on outcomes of the file filters; determining a decision, based on the set of file characteristics, whether to exclude the file from further analysis by a client of an application control system; and based on the decision, excluding the file from the further analysis by the client of the application control system or providing the file to the client of the application control system for further analysis whether to allow or prohibit the operation on the file.