Methods, media, and systems for detecting anomalous program executions
Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
1. A method for detecting anomalous program executions, comprising:
executing at least a portion of a program in an emulator;
comparing a function call made in the emulator to a model of function calls for the at least a portion of the program, wherein the model is a combined model created from at least two models created at different times; and
identifying the function call as anomalous based on the comparison.
2. A method for detecting anomalous program executions, comprising:
executing at least a portion of a program in an emulator;
comparing a function call made in the emulator to a model of function calls for the at least a portion of the program, wherein the model is a combined model created from at least two models created using different computers; and
identifying the function call as anomalous based on the comparison.
3. The method of claim 1 , further comprising modifying the function call so that the function call becomes non-anomalous.
4. The method of claim 1 , further comprising generating a virtualized error in response to the function call being identified as being anomalous.
5. The method of claim 1 , wherein the comparing compares the function call name and arguments to the model.
6. The method of claim 1 , wherein the model reflects normal activity of the at least a portion of the program.
7. The method of claim 1 , wherein the model reflects attacks against the at least a portion of the program.
8. The method of claim 1 , further comprising randomly selecting at least a portion of the model to be used in the comparison from a plurality of different models relating to the program.
9. The method of claim 1 , further comprising notifying another computer of the anomalous function call upon the function call being identified as anomalous.
10. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting anomalous program executions, comprising:
executing at least a portion of a program in an emulator;
comparing a function call made in the emulator to a model of function calls for the at least a portion of the program, wherein the model is a combined model created from at least two models created at different times; and
identifying the function call as anomalous based on the comparison.
11. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting anomalous program executions, comprising:
executing at least a portion of a program in an emulator;
comparing a function call made in the emulator to a model of function calls for the at least a portion of the program, wherein the model is a combined model created from at least two models created using different computers; and
identifying the function call as anomalous based on the comparison.
12. The non-transitory computer-readable medium of claim 10 , wherein the method further comprises modifying the function call so that the function call becomes non-anomalous.
13. The non-transitory computer-readable medium of claim 10 , wherein the method further comprises generating a virtualized error in response to the function call being identified as being anomalous.
14. The non-transitory computer-readable medium of claim 10 , wherein the comparing compares the function call name and arguments to the model.
15. The non-transitory computer-readable medium of claim 10 , wherein the model reflects normal activity of the at least a portion of the program.
16. The non-transitory computer-readable medium of claim 10 , wherein the model reflects attacks against the at least a portion of the program.
17. The non-transitory computer-readable medium of claim 10 , wherein the method further comprises randomly selecting at least a portion of the model to be used in the comparison from a plurality of different models relating to the program.
18. The non-transitory computer-readable medium of claim 10 , wherein the method further comprises notifying another computer of the anomalous function call upon the function call being identified as anomalous.
19. A system for detecting anomalous program executions, comprising:
a processor that:
executes at least a portion of a program in an emulator;
compares a function call made in the emulator to a model of function calls for the at least a portion of the program, wherein the model is a combined model created from at least two models created at different times; and
identifies the function call as anomalous based on the comparison.
20. The system of claim 19 , wherein the method further comprising modifying the function call so that the function call becomes non-anomalous.
21. The system of claim 19 , wherein the method further comprising generating a virtualized error in response to the function call being identified as being anomalous.
22. The system of claim 19 , wherein the comparing compares the function call name and arguments to the model.
23. The system of claim 19 , wherein the model reflects normal activity of the at least a portion of the program.
24. The system of claim 19 , wherein the model reflects attacks against the at least a portion of the program.
25. The system of claim 19 , wherein the method further comprises randomly selecting at least a portion of the model to be used in the comparison from a plurality of different models relating to the program.
26. The system of claim 19 , wherein the method further comprises notifying another computer of the anomalous function call upon the function call being identified as anomalous.
27. A system for detecting anomalous program executions, comprising:
a processor that:
executes at least a portion of a program in an emulator;
compares a function call made in the emulator to a model of function calls for the at least a portion of the program, wherein the model is a combined model created from at least two models created using different computers; and
identifies the function call as anomalous based on the comparison.