Execution profile assembly using branch records
View Patent ↗Technologies for assembling an execution profile of an event are disclosed. The system and method may include recording a plurality of branch records, generating a first test event substantially identical to the event, verifying legitimacy of an owner of a code segment associated with the event, establishing an initial point of an execution chain associated with the event, establishing a final point of the execution chain associated with the event, analyzing branch records for an address associated with the code segment, installing a plurality of primary monitors within the execution chain associated with the event, and triggering the plurality of primary monitors.
1. A system for securing an electronic device, the system comprising:
a memory;
a processor;
a secured system resource; and
one or more security agents for assembling an execution profile of an event, the one or more security agents including instructions resident in the memory and operable for execution by the processor, wherein the security agents are configured to:
record a plurality of branch records;
generate a first test event for the event;
verify legitimacy of an owner of a code segment associated with the event;
establish an initial point of an execution chain associated with the event;
establish a final point of the execution chain associated with the event;
analyze branch records for an address associated with the code segment;
install a plurality of primary monitors within the execution chain associated with the event, including discarding the address based on a determination that is associated with an operating system context switch;
trigger the plurality of primary monitors;
determine whether an execution profile is complete; and
based on a determination that the execution profile is not complete, signal a test event generator to generate a second test event for the event.
2. The system of claim 1 , wherein the security agents are further configured to:
install a plurality of secondary monitors within the execution chain associated with the event; and
trigger the plurality of secondary monitors.
3. The system of claim 1 , wherein installing the plurality of primary monitors comprises determining whether the address is suitable for a primary monitor, the primary monitor being one of the plurality of primary monitors.
4. The system of claim 1 , wherein installing the plurality of primary monitors comprises verifying an identity of a process associated with the execution chain.
5. The system of claim 1 , wherein the security agents are further configured to:
install a plurality of secondary monitors within the execution chain associated with the event, wherein installing the plurality of secondary monitors comprises determining whether the address is suitable for a secondary monitor, the secondary monitor being one of the plurality of secondary monitors; and
trigger the plurality of secondary monitors.
6. The system of claim 1 , wherein the security agents are further configured to:
install a plurality of secondary monitors within the execution chain associated with the event, wherein installing the plurality of secondary monitors comprises discarding the address if it is associated with a switching task; and
trigger the plurality of secondary monitors.
7. The system of claim 1 , wherein the security agents are further configured to:
install a plurality of secondary monitors within the execution chain associated with the event, wherein installing the plurality of secondary monitors comprises verifying an identity of a process associated with the execution chain; and
trigger the plurality of secondary monitors.
8. The system of claim 1 , wherein the security agents are further configured to:
install a plurality of secondary monitors within the execution chain associated with the event;
trigger the plurality of secondary monitors;
determine whether an execution profile is complete; and
based on a determination that the execution profile is not complete, signal a test event generator to generate a second test event for the event.
9. The system of claim 1 , wherein the plurality of primary monitors are selected from the group consisting of: a plurality of inline hooks, a plurality of virtualization-based monitors, and a plurality of hardware-based monitors.
10. A method for assembling an execution profile of an event, the method comprising:
recording a plurality of branch records;
generating a first test event substantially identical to the event;
verifying legitimacy of an owner of a code segment associated with the event;
establishing an initial point of an execution chain associated with the event;
establishing a final point of the execution chain associated with the event;
analyzing branch records for an address associated with the code segment;
installing a plurality of primary monitors within the execution chain associated with the event, including discarding the address based on a determination that is associated with an operating system context switch;
triggering the plurality of primary monitors
determining whether the execution profile is complete; and
based on a determination that the execution profile is not complete, signaling the test event generator to generate a second test event substantially identical to the event.
11. The method of claim 10 , further comprising:
installing a plurality of secondary monitors within the execution chain associated with the event; and
triggering the plurality of secondary monitors.
12. The method of claim 10 , wherein installing a plurality of primary monitors comprises determining whether the address is suitable for a primary monitor, the primary monitor being one of the plurality of primary monitors.
13. The method of claim 10 , wherein installing a plurality of primary monitors comprises verifying an identity of a process associated with the execution chain.
14. The method of claim 10 , further comprising:
installing a plurality of secondary monitors within the execution chain associated with the event, wherein installing the plurality of secondary monitors comprises determining whether the address is suitable for a secondary monitor, the secondary monitor being one of the plurality of secondary monitors; and
triggering the plurality of secondary monitors.
15. At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
recording a plurality of branch records;
generate a first test event substantially identical to the event;
verify legitimacy of an owner of a code segment associated with the event;
establish an initial point of an execution chain associated with the event;
establish a final point of the execution chain associated with the event;
analyze branch records for an address associated with the code segment;
install a plurality of primary monitors within the execution chain associated with the event, including discarding the address based on a determination that is associated with an operating system context switch;
trigger the plurality of primary monitors
determining whether the execution profile is complete; and
based on a determination that the execution profile is not complete, signaling the test event generator to generate a second test event substantially identical to the event.
16. The medium of claim 15 , wherein the processor is further caused to:
install a plurality of secondary monitors within the execution chain associated with the event; and
trigger the plurality of secondary monitors.
17. The medium of claim 15 , wherein installing a plurality of primary monitors comprises determining whether the address is suitable for a primary monitor, the primary monitor being one of the plurality of primary monitors.
18. The medium of claim 15 , wherein installing a plurality of primary monitors comprises verifying an identity of a process associated with the execution chain.