Systems and methods for detecting a process to establish a backdoor connection with a computing device

摘要

A computer-implemented method for detecting a process to establish a backdoor connection with the computer is described. An application programming interface (API) is hooked. Calls to the hooked API are monitored. A call directed to the hooked API is intercepted. The call instructs the API to initiate a user interface. Structures included in the intercepted call are analyzed. The intercepted call is prevented from arriving at the hooked API if the structures are directed to a socket on the computer.