Granted Patent B1

US 7,793,346 · App. 10/346,969 · Granted Sep 7, 2010

Abstract

Claims (95)

1. A method for preventing unauthorized program modules from communicating, comprising:

identifying at least one program module utilizing a central processing unit call history by intercepting a function, the central processing unit call history including a history of a plurality of calls in the form of a stack trace;

performing an authorization test on the at least one program module for preventing unauthorized program modules from communicating; and

determining whether an application program associated with the at least one program module is authorized based on a stack context of the function;

wherein if the application program is authorized only in part:

(a) it is determined whether one of the program modules of the application program is authorized,

(b) results of (a) are stored,

(c) if the program module fails to be authorized: at least one of the function is failed and the application program is terminated,

(d) (a)-(c) are repeated for each of the program modules of the application program, and

(e) the function is passed if all of the program modules are authorized;

wherein a signature is used to determine whether the at least one program module is authorized;

wherein the signature includes a calculated signature associated with the at least one program module, and the calculated signature is compared to an earlier-stored signature stored in a database and associated with the at least one program module.

2. The method as recited in claim 1 , wherein the function includes a socket function.

3. The method as recited in claim 1 , wherein if the application program is authorized in whole, the function is passed.

4. The method as recited in claim 1 , wherein if the application program is unauthorized in whole, at least one of terminating the application program and failing the function.

5. The method as recited in claim 1 , wherein a manual test is used to determine whether the at least one program module is authorized.

6. The method as recited in claim 1 , wherein user intervention is used to determine whether the at least one program module is authorized.

7. The method as recited in claim 1 , wherein the database is used to determine whether the at least one program module is authorized.

8. The method as recited in claim 7 , wherein a checksum is used to determine whether the at least one program module is authorized.

9. The method as recited in claim 1 , wherein the stored determination is used during subsequent determinations as to whether the at least one program module is authorized.

10. The method as recited in claim 1 , wherein if at least one of the program modules is unauthorized, the function is failed.

11. The method as recited in claim 1 , wherein if at least one of the program modules is unauthorized, the program is terminated.

12. The method as recited in claim 1 , wherein the unauthorized program modules are prevented from communicating to prevent a virus associated with the unauthorized program modules from communicating.

13. The method as recited in claim 12 , wherein the virus includes a Trojan virus.

14. The method as recited in claim 13 , wherein the virus includes a Trojan DLL virus.

15. The method as recited in claim 1 , wherein the identifying and the performing are carried out utilizing a firewall.

16. A system for preventing unauthorized program modules from communicating, comprising:

memory for storing an application program and a central processing unit call history, the central processing unit call history including a history of a plurality of calls in the form of a stack trace; and

a processor coupled to the memory, the processor capable of identifying at least one program module of the application program utilizing the central processing unit call history by intercepting a function, performing an authorization test on the at least one program module for preventing unauthorized program modules from communicating, and determining whether the application program associated with the at least one program module is authorized based on a stack context of the function;

wherein the system is operable such that if the application program is authorized only in part:

(a) it is determined whether one of the program modules of the application program is authorized,

(b) results of (a) are stored,

(c) if the program module fails to be authorized: at least one of the function is failed and the application program is terminated,

(d) (a)-(c) are repeated for each of the program modules of the application program, and

(e) the function is passed if all of the program modules are authorized;

wherein a signature is used to determine whether the at least one program module is authorized;

wherein the signature includes a calculated signature associated with the at least one program module, and the calculated signature is compared to an earlier-stored signature stored in a database and associated with the at least one program module.

17. A system for preventing unauthorized program modules from communicating, comprising:

means for identifying at least one program module utilizing a central processing unit call history by intercepting a function, the central processing unit call history including a history of a plurality of calls in the form of a stack trace;

means for performing an authorization test on the at least one program module for preventing unauthorized program modules from communicating; and

means for determining whether an application program associated with the at least one program module is authorized based on a stack context of the function;

wherein the system is operable such that if the application program is authorized only in part:

(a) it is determined whether one of the program modules of the application program is authorized,

(b) results of (a) are stored,

(c) if the program module fails to be authorized: at least one of the function is failed and the application program is terminated,

(d) (a)-(c) are repeated for each of the program modules of the application program, and

(e) the function is passed if all of the program modules are authorized;

wherein a signature is used to determine whether the at least one program module is authorized;

wherein the signature includes a calculated signature associated with the at least one program module, and the calculated signature is compared to an earlier-stored signature stored in a database and associated with the at least one program module.

18. A computer program product stored on a non-transitory computer readable medium for preventing unauthorized program modules from communicating, comprising:

computer code for identifying at least one program module utilizing a central processing unit call history by intercepting a function, the central processing unit call history including a history of a plurality of calls in the form of a stack trace;

computer code for performing an authorization test on the at least one program module for preventing unauthorized program modules from communicating; and

computer code for determining whether an application program associated with the at least one program module is authorized based on a stack context of the function;

wherein the computer program product is operable such that if the application program is authorized only in part:

(a) it is determined whether one of the program modules of the application program is authorized,

(b) results of (a) are stored,

(c) if the program module fails to be authorized: at least one of the function is failed and the application program is terminated,

(d) (a)-(c) are repeated for each of the program modules of the application program, and

(e) the function is passed if all of the program modules are authorized;

wherein a signature is used to determine whether the at least one program module is authorized;

wherein the signature includes a calculated signature associated with the at least one program module, and the calculated signature is compared to an earlier-stored signature stored in a database and associated with the at least one program module.

19. A method for preventing Trojan viruses from communicating, comprising:

intercepting at least one function;

identifying at least one program module of an application program associated with the at least one function utilizing a central processing unit call history by intercepting the at least one function, the central processing unit call history including a history of a plurality of calls in the form of a stack trace;

determining whether the at least one program module of the application program is authorized for preventing Trojan viruses from communicating based on a stack context of the function;

wherein if the application program is authorized only in part:

(a) it is determined whether one of the program modules of the application program is authorized,

(b) results of (a) are stored,

(c) if the program module fails to be authorized: at least one of the function is failed and the application program is terminated,

(d) (a)-(c) are repeated for each of the program modules of the application program, and

(e) the function is passed if all of the program modules are authorized;

wherein a signature is used to determine whether the at least one program module is authorized;

wherein the signature includes a calculated signature associated with the at least one program module, and the calculated signature is compared to an earlier-stored signature stored in a database and associated with the at least one program module.

20. A method for preventing Trojan viruses from communicating, comprising:

intercepting at least one function;

identifying at least one program module of an application program associated with the at least one function utilizing a central processing unit call history by intercepting the at least one function, the central processing unit call history including a history of a plurality of calls in the form of a stack trace;

determining whether the application program is authorized based on a stack context of the function;

if the application program is authorized in whole: passing the function;

if the application program is unauthorized in whole: at least one of failing the function and terminating the application program; and

if the application program is authorized only in part:

(a) determining whether one of the program modules of the application program is authorized,

(b) storing results of (a),

(c) if the program module fails to be authorized: at least one of failing the function and terminating the application program,

(d) repeating (a)-(c) for each of the program modules of the application program, and

(e) if all of the program modules are authorized: passing the function;

wherein a signature is used to determine whether the one of the program modules of the application program is authorized;

wherein the signature includes a calculated signature associated with the one of the program modules, and the calculated signature is compared to an earlier-stored signature stored in a database and associated with the one of the program modules.

21. The method as recited in claim 1 , wherein the stack trace is configured to deal with a break down when arriving at a function that fails to set up a frame.

22. The method as recited in claim 1 , wherein the identifying at least one program module utilizing the central processing unit call history is supplemented by exception frame information.

23. The method as recited in claim 1 , wherein the identifying at least one program module utilizing the central processing unit call history is supplemented by a brute force analysis of a central processing unit stack.

24. The method as recited in claim 1 , wherein the function includes a transport function, comprising one of a send data to address function and a receive data from address function.

25. The method as recited in claim 1 , wherein intercepting the function recovers a central processing unit context of the function and the at least one program module is identified based on the recovered central processing unit context.

26. The method as recited in claim 1 , wherein the call history is reconstructed by analyzing one or more stack frame linkages.

27. The method as recited in claim 1 , wherein the calculated signature includes a checksum.

28. The method as recited in claim 1 , wherein if the at least one program module is authorized, the calculated signature associated with the at least one program module is stored in the database and associated with the at least one program module.

Assignments (8)