a security system and method efficiently monitors and secures a computer to defend against malicious intrusions , and includes an in - band software monitor disposed within a kernel in communication with an operating system of the computer . the monitor intercepts system calls made from an msr , to execute monitoring operations , and subsequently returns execution to the os . an out - of - band hypervisor communicably coupled to the os , has read shadow means for trapping read requests to the msr , and write mask means for trapping write requests to the msr . the hypervisor includes means for responding to the trapped read and write requests so that presence of the monitor is obscured .