Granted Patent B1

US 7,904,955 · App. 10/172,138 · Granted Mar 8, 2011

Abstract

Claims (69)

1. A method of detecting shellcode, comprising:

scanning a set of computer instructions for the presence of a null operation instruction utilizing a processor;

examining said set of computer instructions for the presence of a system call instruction;

reviewing said set of computer instructions for the presence of a decoder instruction set including a jump instruction for acting as an encoded system call instruction, said jump instruction invoking a function in the absence of said system call instruction from said set of computer instructions;

determining a null operation weight value corresponding to said null operation instruction;

assessing a system call weight value corresponding to said system call instruction;

calculating a decoder weight value corresponding to said decoder instruction set; and

analyzing said null operation weight value, said system call weight value, and said decoder weight value to identify a shellcode.

2. The method of claim 1 wherein said examining includes examining said set of computer instructions for the presence of a system call instruction for invoking a function provided by a computer.

3. A method of detecting a shellcode, comprising:

establishing a null operation threshold related to a null operation instruction in a set of computer instructions;

generating a system call threshold related to a system call instruction in said set of computer instructions utilizing a processor;

providing a decoder threshold related to the presence of a decoder instruction set in said set of computer instructions;

determining a null operation weight value corresponding to the presence of said null operation instruction in said set of computer instructions;

assessing a system call weight value corresponding to the presence of said system call instruction in said set of computer instructions;

calculating a decoder weight value corresponding to the presence of said decoder instruction set including a jump instruction for acting as an encoded system call instruction, said jump instruction invoking a function in the absence of said system call instruction from said set of computer instructions; and

comparing said null operation weight value, said system call weight value, and said decoder weight value to said null operation threshold, said system call threshold, and said decoder threshold so as to estimate whether said set of computer instructions is a shellcode.

4. The method of claim 3 wherein said assessing includes assessing a system call weight value corresponding to the presence of a system call instruction for invoking a function provided by a computer.

5. A tangible computer readable memory that can direct a computer to function in a specified manner, comprising:

instructions to scan a set of computer instructions for the presence of a null operation instruction;

instructions to examine said set of computer instructions for the presence of a system call instruction;

instructions to review said set of computer instructions for the presence of a decoder instruction set including a jump instruction for acting as an encoded system call instruction, said jump instruction invoking a function in the absence of said system call instruction from said set of computer instructions;

instructions to determine a null operation weight value corresponding to said null operation instruction;

instructions to assess a system call weight value corresponding to said system call instruction;

instructions to calculate a decoder weight value corresponding to said decoder instruction set; and

instructions to analyze said null operation weight value, said system call weight value, and said decoder weight value to identify a shellcode.

6. The computer readable memory of claim 5 wherein said instructions to examine include instructions to examine said set of computer instructions for the presence of a system call instruction for invoking a function provided by a computer.

7. A tangible computer readable memory that can direct a computer to function in a specified manner, comprising:

instructions to establish a null operation threshold related to a null operation instruction in a set of computer instructions;

instructions to generate a system call threshold related to a system call instruction in said set of computer instructions;

instructions to provide a decoder threshold related to the presence of a decoder instruction set in said set of computer instructions;

instructions to determine a null operation weight value corresponding to the presence of said null operation instruction in said set of computer instructions;

instructions to assess a system call weight value corresponding to the presence of said system call instruction in said set of computer instructions;

instructions to calculate a decoder weight value corresponding to the presence of said decoder instruction set including a jump instruction for acting as an encoded system call instruction, said jump instruction invoking a function in the absence of said system call instruction from said set of computer instructions; and

instructions to compare said null operation weight value, said system call weight value, and said decoder weight value to said null operation threshold, said system call threshold, and said decoder threshold so as to estimate whether said set of computer instructions is a shellcode.

8. The computer readable memory of claim 7 wherein said instructions to assess include instructions to assess a system call weight value corresponding to the presence of a system call instruction for invoking a function provided by a computer.

9. A method of detecting a shellcode, comprising:

scanning a set of computer instructions for a null operation instruction utilizing a processor;

examining the set of computer instructions for a system call instruction;

reviewing the set of computer instructions for a decoder instruction set including a jump instruction for acting as an encoded system call instruction, the jump instruction invoking a function in the absence of the system call instruction from the set of computer instructions; and

detecting a shellcode based at least in part on at least one of the null operation instruction, the system call instruction, and the decoder instruction set.

10. The method of claim 9 , wherein the shellcode is detected based at least in part on the null operation instruction.

11. The method of claim 9 , wherein the shellcode is detected based at least in part on the system call instruction.

12. The method of claim 9 , wherein the shellcode is detected based at least in part on the decoder instruction set.

13. A computer program product embodied on a tangible computer readable medium for detecting a shellcode, comprising:

computer code for scanning a set of computer instructions for a null operation instruction;

computer code for examining the set of computer instructions for a system call instruction;

computer code for reviewing the set of computer instructions for a decoder instruction set including a jump instruction for acting as an encoded system call instruction, the jump instruction invoking a function in the absence of the system call instruction from the set of computer instructions; and

computer code for detecting a shellcode based at least in part on at least one of the null operation instruction, the system call instruction, and the decoder instruction set.

14. A method of detecting a shellcode, comprising:

scanning a set of computer instructions for at least two instructions of a null operation instruction, a system call instruction, and a decoder instruction set utilizing a processor;

reviewing the set of computer instructions for the presence of a decoder instruction set including a jump instruction for acting as an encoded system call instruction, the jump instruction invoking a function in the absence of the system call instruction from the set of computer instructions; and

detecting a shellcode based at least in part on the at least two instructions.

15. A system for detecting shellcode, comprising:

a processor for:

scanning a set of computer instructions for a null operation instruction;

examining the set of computer instructions for a system call instruction;

reviewing the set of computer instructions for a decoder instruction set including a jump instruction for acting as an encoded system call instruction, the jump instruction invoking a function in the absence of the system call instruction from the set of computer instructions; and

detecting a shellcode based at least in part on at least one of the null operation instruction, the system call instruction, and the decoder instruction set.

16. A computer program product embodied on a tangible computer readable medium for detecting a shellcode, comprising:

computer code for scanning a set of computer instructions for at least two instructions of a null operation instruction, a system call instruction, and a decoder instruction set;

computer code for reviewing the set of computer instructions for the presence of a decoder instruction set including a jump instruction for acting as an encoded system call instruction, the jump instruction invoking a function in the absence of the system call instruction from the set of computer instructions; and

computer code for detecting a shellcode based at least in part on the at least two instructions.

17. A system for detecting a shellcode, comprising:

a processor for:

scanning a set of computer instructions for at least two instructions of a null operation instruction, a system call instruction, and a decoder instruction set;

reviewing the set of computer instructions for the presence of a decoder instruction set including a jump instruction for acting as an encoded system call instruction, the jump instruction invoking a function in the absence of the system call instruction from the set of computer instructions; and

detecting a shellcode based at least in part on the at least two instructions.

18. The method of claim 1 , further comprising determining a number of instructions in the set of computer instructions.

Assignments (9)