4. The method as recited in claim 1 , wherein the call is selected from the group consisting of a system call, a user mode call, a kernel mode call, a function call, a network message call, a remote procedure call, a queued message call, an application program interface (API) call, and a calling routine.
1. A security method, comprising: (a) providing a repository which is able to store initial cryptographic certificates and policies for resources including, but not limited to, executable files, whereby the resource's author can be authenticated, and system calls that are necessary for malicious behaviour are identified, (b) providing a repository which is able to store initial security policies, (c) providing a repository which is able to store loaded files and processes state information, (d) providing a memory which is able to store executable code, (e) intercepting a call, (f) determining whether the call is a request to load an executable file into said memory, (g) when it is determined that the call is a request to load an executable file into said memory, analysing the cryptographic compliance as per initially determined policies and determining whether it is compliant, (h) when it is determined that the file is compliant with said cryptographic policies, loading said file into said memory, assigning it full rights, updating state information related to the call, the associated file including, but not limited to, the unequivocal identification of the resource's author, and the newly loaded process into said memory, (i) when it is determined that the file is not compliant with cryptographic policies, loading said file into memory, assigning it limited rights, updating state information related to the call, the associated file, and the newly loaded process into said memory, (j) when it is determined that the call is not a request to load an executable file into memory, determining whether the call is a restricted call as per the initially determined security policies, (k) when it is determined that the call is restricted, determining the calling process rights based on the state machine information of the calling process hierarchy, (l) when it is determined that the process is not authorised, updating the state machine information, reacting to the unauthorised call, (m) when it is determined that the process is authorised, updating the state machine information, returning control to the operating system, repeating (c)-(m); wherein an interceptor intercepts the call and forwards the call to a detector, wherein the detector includes an infrastructure for providing a state machine; whereby executable files requiring full rights will need to comply with said initial cryptographic certificates and policies, including but not limited to unequivocal identification of the resource's author, whereby executable files with limited rights will not be able to perform activities, including, but not limited to, system calls, necessary for malware's malicious behaviour as defined in the initial policies; whereby the revocation of the cryptographic certificates of the resources, including, but not limited to, executable files, will prevent the propagation of malware without the need for distribution of updates for the security method here described; whereby the post-mortem analysis of the cryptographic certificates of malware allows for the legal prosecution and accountability of the malware's authors.