A Whitelist-Based Interception System for Suspicious Executable and Script Files in Windows

Modern computing environments increasingly suffer from security threats that exploit vulnerabilities in executable programs and script files. Traditional antivirus solutions relying on signature matching are often inadequate against new, unknown, or polymorphic malware. This paper presents a novel system architecture based on a whitelist strategy for intercepting suspicious executable and script files on Windows platforms. The system leverages both user-mode and kernel-mode components and utilizes the Windows Minifilter framework to intercept file system I/O operations. By scanning the file system to generate a trusted whitelist database and cross-verifying file execution requests against this database, our approach effectively prevents the execution of unauthorized files. Importantly, whitelist-based systems are especially suitable for environments with stable software configurations and minimal change—such as industrial control systems—where a fixed set of trusted applications can be maintained reliably. This feature makes the proposed system ideal for scenarios where operational stability is critical. This paper describes the design, implementation, and operational flow of the system, and discuss its advantages, potential limitations, and future research directions.