System and method for indirect interface monitoring and plumb-lining
A method is provided in one example embodiment that includes monitoring a first interface, monitoring a second interface, and taking a policy action if the second interface is not executed before the first interface. In more particular embodiments, monitoring the second interface may include walking a call stack associated with the first interface. Moreover, a program context for calling code associated with the second interface may be identified and acted upon.
1. A method, comprising:
monitoring, by a processor, a first interface by directly monitoring the first interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack;
monitoring, by the processor, a second interface by:
identifying, based on a callback, a calling code associated with the second interface by unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the stack; and
identifying a program context associated with the calling code; and
taking a policy action if the second interface is not executed before the first interface.
2. The method of claim 1 , wherein monitoring the second interface comprises indirectly monitoring the second interface.
3. The method of claim 1 , wherein monitoring the second interface comprises walking a call stack associated with the first interface.
4. The method of claim 1 , further comprising: determining if the calling code is legitimate; and
taking the policy action if the calling code is not legitimate.
5. The method of claim 1 , wherein monitoring the first interface comprises:
storing data associating an execution element with the first interface.
6. The method of claim 1 , wherein:
the first interface is a kernel-mode interface; and
monitoring the second interface comprises walking a call stack associated with the kernel-mode interface.
7. The method of claim 1 , wherein:
monitoring the first interface comprises receiving a callback on execution of the first interface and storing data associating an execution element with the execution of the first interface.
8. The method of claim 1 , further comprising tracking an execution element associated with the first interface and wherein the policy action is taken if the second interface is not executed by the execution element.
9. The method of claim 8 , wherein the tracking includes storing an identifier of the execution element and a time of execution associated with the execution element.
10. The method of claim 8 , wherein the execution element is at least one of:
a thread; and
a fiber.
11. The method of claim 1 , wherein the call frame further includes one or more local variables for the calling code.
12. One or more non-transitory tangible media encoding logic that include instructions for execution that, when executed by a processor, is operable to perform operations comprising:
monitoring, by a processor, a first interface by directly monitoring the first interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack;
monitoring, by the processor, a second interface by:
identifying, based on a callback, a calling code associated with the second interface from one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed onto the stack;
identifying a function within the calling code to determine security of the function; and
taking a policy action if the second interface is not executed before the first interface.
13. The media of claim 12 , wherein the operations further comprise:
tracking an execution element associated with the first interface and wherein the policy action is taken if the second interface is not executed by the execution element.
14. The media of claim 13 , wherein the tracking includes storing an identifier of the execution element and a time of execution associated with the execution element.
15. The media of claim 12 , wherein identifying the calling code includes:
unwinding the call frame to access each entry of the call frame;
determining whether an entry points to valid memory within a process address space; and
if the entry points to valid memory, determining whether the entry is the pointer that points to the calling code and not data within the memory.
16. The media of claim 12 , wherein the operations further comprise:
determining a type of memory pointed to by the pointer.
17. The media of claim 16 , wherein the type of memory is at least one of:
memory backed by a loaded executable application file;
memory not backed by a loaded executable application file; and
memory containing interpreted code.