System and method for conducting operational flow forensics
Disclosed herein is an algorithm selector logic for determining an operational flow of operating system (OS) components. The algorithm selector logic features data retrieval logic, emulation logic, trace generation logic and software component selection logic. The data retrieval logic retrieves a targeted memory structure for an OS component. The emulation logic conducts emulation operations on the OS component. The trace generation logic inserts intercept points at memory address offset locations that correspond to parameters within the targeted memory structure to generate a trace. The software component selection logic compares an execution flow associated with the generated trace with known execution flows, where the known execution flows are associated with different OS versions. When correlation between the execution flow and the known execution flows are not in correlation, the software component selection logic identifies the OS component may be compromised or further analytics of the OS component is required.
1 . An algorithm selector logic circuitry for determining an operational flow of operating system (OS) components, the algorithm selector logic circuitry comprising:
data retrieval logic circuitry configured to retrieve a targeted memory structure that stores an OS component of the OS components;
emulator logic circuitry configured to conduct emulation operations on the OS component;
trace generation logic circuitry configured to insert one or more intercept points at memory address offset locations that correspond to parameters within the targeted memory structure to generate a trace that records the parameters accessed and an order of access by one or more processes accessing the parameters of the OS component stored within the targeted memory structure at the memory offset locations where the one or more intercept points are inserted; and
software component selection logic circuitry configured to compare an execution flow associated with the generated trace with known execution flows, the known execution flows are associated with different OS versions,
wherein when correlations between the execution flow and the known execution flows fail to meet a prescribed level of correlation, the software component selection logic circuitry identifies the OS component may be compromised or further analytics of the OS component is required.
2 . The algorithm selector logic circuitry of claim 1 , wherein the targeted memory structure provided to the logic circuitry is a subset of memory structures for the OS components as detected by undocumented structure extractor logic circuitry or undocumented offset extractor logic circuitry.
3 . The algorithm selector logic circuitry of claim 1 , wherein when a correlation between the execution flow and a known execution flow exceeds the prescribed level of correlation, the software component selection logic circuitry identifies the OS component corresponds to an OS component that performs the known execution flow.
4 . The algorithm selector logic circuitry of claim 3 , wherein successive determinations of the execution flows of the memory structures enables formulation of a collection of actual OS components utilized by an OS of a targeted computing device relied upon for a memory audit.
5 . The algorithm selector logic circuitry of claim 1 being part of an intelligence extraction system to conduct a memory audit that comprises (i) an undocumented structure extractor logic circuitry configured to identify known, but undocumented, memory structures associated with software installed on a targeted computing device and (ii) an undocumented offset extractor logic circuitry configured to identify undocumented and unknown memory structures associated with the software installed on the targeted computing device.
6 . A computerized method comprising:
retrieving a targeted memory structure that stores an OS component;
conducting emulation operations on the OS component;
inserting one or more intercept points at memory address offset locations that correspond to parameters within the targeted memory structure to generate a trace that records the parameters accessed and an order of access by one or more processes accessing the parameters of the OS component stored within the targeted memory structure at the memory offset locations where the one or more intercept points are inserted; and
comparing an execution flow associated with the generated trace with known execution flows, the known execution flows are associated with different OS versions,
wherein identifying the OS component may be compromised or further analytics of the OS component is required when correlations between the execution flow and the known execution flows fail to meet a prescribed level of correlation.
7 . The computerized method of claim 6 , wherein the targeted memory structure is a subset of memory structures for the OS components as detected by undocumented structure extractor logic circuitry or undocumented offset extractor logic circuitry.
8 . The computerized method of claim 6 , wherein identifying the OS component corresponds to an OS component that performs a known execution flow when a correlation between the execution flow and the known execution flow exceeds the prescribed level of correlation.
9 . The computerized method of claim 8 , wherein successive determinations of the execution flows of the memory structures enables formulation of a collection of actual OS components utilized by an OS of a targeted computing device relied upon for a memory audit.
10 . An intelligence extraction system to conduct a memory audit, the intelligence extraction system comprising:
logic circuitry configured to identify known, but undocumented, operating system (OS) components and undocumented and unknown OS components associated with software installed on a targeted computing device; and
an algorithm selector logic circuitry configured to determine an operational flow of the OS components, the algorithm selector logic circuitry comprises
data retrieval logic circuitry configured to retrieve a targeted memory structure that stores an OS component of the OS components,
emulator logic circuitry configured to conduct emulation operations on the OS component,
trace generation logic circuitry configured to insert one or more intercept points at memory address offset locations that correspond to parameters within the targeted memory structure to generate a trace that records the parameters accessed and an order of access by one or more processes accessing the parameters of the OS component stored within the targeted memory structure at the memory offset locations where the one or more intercept points are inserted, and
software component selection logic circuitry configured to compare an execution flow associated with the generated trace with known execution flows, the known execution flows are associated with different OS versions,
wherein when correlations between the execution flow and the known execution flows fail to meet a prescribed level of correlation, the software component selection logic circuitry identifies the OS component may be compromised or further analytics of the OS component is required.
11 . The intelligence extraction system of claim 10 , wherein the targeted memory structure provided to the emulator logic circuitry of the algorithm selector logic circuitry is a subset of memory structures for the OS components as detected by the logic circuitry.
12 . The intelligence extraction system of claim 10 , wherein when a correlation between the execution flow and a known execution flow exceeds the prescribed level of correlation, the software component selection logic circuitry identifies the OS component corresponds to an OS component that performs the known execution flow.
13 . The intelligence extraction system of claim 12 , wherein successive determinations of the execution flows of the memory structures enables formulation of a collection of actual OS components utilized by an OS of the targeted computing device relied upon for a memory audit.