Granted Patent B2

US 8,590,041 · App. 13/305,581 · Granted Nov 19, 2013

Abstract

Claims (111)

1. A computer-implemented method for preventing malware attacks, comprising:

launching an application on an electronic device;

intercepting one or more instructions from the application, the application attempting to execute the one or more instructions;

determining whether the one or more instructions includes an attempt to access a sensitive system resource of the electronic device;

rewriting the one or more instructions to access a secured system resource of the electronic device;

executing the rewritten instructions on the electronic device;

observing the results of the rewritten instructions;

determining whether the results of rewritten instructions indicate an attempted malicious action; and

based on the determination of the results, determining that the application is associated with malware.

2. The method of claim 1 , wherein:

intercepting the one or more instructions includes intercepting a first segment of instructions and a second segment of instructions; and

determining whether the one or more instructions includes an attempt to access a sensitive system resource and rewriting the one or more instructions includes:

determining whether the first segment includes an attempt to access a first sensitive system resource;

based on such a determination, rewriting the first segment to access a first secured system resource;

determining whether the second segment includes an attempt to access a second sensitive system resource; and

based on such a determination, rewriting the second segment to access a second system resource.

3. The method of claim 1 , wherein determining whether the instructions include an attempt to access a sensitive system resource comprises determining whether the attempt corresponds to a known method of malware attack on the electronic device.

4. The method of claim 1 , wherein rewriting the instructions includes:

rewriting a suspicious instruction accessing the sensitive system resource; and

maintaining a non-suspicious instruction not accessing the sensitive system resource.

5. The method of claim 1 , further comprising:

determining whether the one or more instructions includes a repeat of the attempt to access the sensitive resource of the electronic device; and

based on such a determination, executing the rewritten instructions without repeating the rewrite of the one or more instructions.

6. The method of claim 1 , wherein:

the sensitive system resource includes a registry; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed registry.

7. The method of claim 1 , wherein:

the sensitive system resource includes a file; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed file.

8. The method of claim 1 , wherein:

the sensitive system resource includes an address in memory; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed address in memory.

9. The method of claim 1 , wherein

the sensitive system resource includes an operating system function; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed operating system function.

10. The method of claim 1 , wherein:

the sensitive system resource includes a driver; and

rewriting the one or more instructions includes rewriting the instructions to load a spoofed driver.

11. An article of manufacture, comprising:

a non-transitory computer readable medium; and

computer-executable instructions carried on the non-transitory computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:

launch an application on an electronic device;

intercept one or more instructions from the application, the application attempting to execute the one or more instructions;

determine whether the one or more instructions includes an attempt to access a sensitive system resource of the electronic device;

rewrite the one or more instructions to access a secured system resource of the electronic device;

execute the rewritten instructions on the electronic device;

observe the results of the rewritten instructions;

determine whether the results of rewritten instructions indicate an attempted malicious action; and

based on the determination of the results, determine that the application is associated with malware.

12. The article of claim 11 , wherein:

intercepting the one or more instructions includes intercepting a first segment of instructions and a second segment of instructions; and

determining whether the one or more instructions includes an attempt to access a sensitive system resource and rewriting the one or more instructions includes:

determining whether the first segment includes an attempt to access a first sensitive system resource;

based on such a determination, rewriting the first segment to access a first secured system resource;

determining whether the second segment includes an attempt to access a second sensitive system resource; and

based on such a determination, rewriting the second segment to access a second system resource.

13. The article of claim 11 , wherein determining whether the instructions include an attempt to access a sensitive system resource comprises determining whether the attempt corresponds to a known method of malware attack on the electronic device.

14. The article of claim 11 , wherein causing the processor to rewrite the instructions includes causing the processor to:

rewrite a suspicious instruction accessing the sensitive system resource; and

maintain a non-suspicious instruction not accessing the sensitive system resource.

15. The article of claim 11 , wherein:

the sensitive system resource includes a registry; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed registry.

16. The article of claim 11 , wherein:

the sensitive system resource includes a file; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed file.

17. The article of claim 11 , wherein:

the sensitive system resource includes an address in memory; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed address in memory.

18. The article of claim 11 , wherein

the sensitive system resource includes an operating system function; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed operating system function.

19. The article of claim 11 , wherein:

the sensitive system resource includes a driver; and

rewriting the one or more instructions includes rewriting the instructions to load a spoofed driver.

20. A system for preventing malware attacks, comprising:

a processor coupled to a memory; and

a dynamic optimization framework executed by the processor, resident within the memory, the framework configured to:

launch an application on an electronic device;

intercept one or more instructions from the application, the application attempting to execute the one or more instructions;

determine whether the one or more instructions includes an attempt to access a sensitive system resource of the electronic device;

rewrite the one or more instructions to access a secured system resource of the electronic device;

execute the rewritten instructions on the electronic device;

observe the results of the rewritten instructions;

determine whether the results of rewritten instructions indicate an attempted malicious action; and

based on the determination of the results, determine that the application is associated with malware.

21. The system of claim 20 , wherein: intercepting the one or more instructions includes intercepting a first segment of instructions and a second segment of instructions; and

determining whether the one or more instructions includes an attempt to access a sensitive system resource and rewriting the one or more instructions includes:

determining whether the first segment includes an attempt to access a first sensitive system resource;

based on such a determination, rewriting the first segment to access a first secured system resource;

determining whether the second segment includes an attempt to access a second sensitive system resource; and

based on such a determination, rewriting the second segment to access a second system resource.

22. The system of claim 20 , wherein determining whether the instructions include an attempt to access a sensitive system resource comprises determining whether the attempt corresponds to a known method of malware attack on the electronic device.

23. The system of claim 20 , wherein configuring the framework to rewrite the instructions includes configuring the framework to:

rewrite a suspicious instruction accessing the sensitive system resource; and

maintain a non-suspicious instruction not accessing the sensitive system resource.

24. The system of claim 20 , wherein:

the sensitive system resource includes a registry; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed registry.

25. The system of claim 20 , wherein:

the sensitive system resource includes a file; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed file.

26. The system of claim 20 , wherein:

the sensitive system resource includes an address in memory; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed address in memory.

27. The system of claim 20 , wherein

the sensitive system resource includes an operating system function; and

rewriting the one or more instructions includes rewriting the instructions to access a spoofed operating system function.

28. The system of claim 20 , wherein:

the sensitive system resource includes a driver; and

rewriting the one or more instructions includes rewriting the instructions to load a spoofed driver.

Assignments (10)