System and method for indirect interface monitoring and plumb-lining
View Patent ↗A method is provided in one example embodiment that includes monitoring a first interface, monitoring a second interface, and taking a policy action if the second interface is not executed before the first interface. In more particular embodiments, monitoring the second interface may include walking a call stack associated with the first interface. Moreover, a program context for calling code associated with the second interface may be identified and acted upon.
1. One or more non-transitory tangible media encoding logic that include instructions for execution that, when executed by a processor, is operable to perform operations comprising:
monitoring a first interface and a second interface at a first level for one or more predetermined activities associated with the second interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack and wherein the monitoring includes directly monitoring the first interface and indirectly monitoring the second interface;
identifying a first predetermined activity based on a callback for a calling code associated with the second interface, wherein the calling code is contained within the call frame of the call stack associated with the first interface, wherein the identifying includes unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the call stack;
determining if a policy associated with the first predetermined activity indicates a second level of monitoring; and
adjusting the monitoring from the first level to a second level if indicated by the policy.
2. The media of claim 1 , the operations further comprising:
repeating the monitoring, the identifying, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.
3. The media of claim 1 , wherein adjusting the monitoring from the first level to the second level includes at least one of:
increasing the monitoring to the second level by adding particular predetermined activities to the monitoring; and
decreasing the monitoring to the second level by removing particular predetermined activities from the monitoring.
4. The media of claim 1 , wherein adjusting the monitoring from the first level to the second level includes one of:
increasing the monitoring to the second level by adding monitoring for accesses that can be performed by the identified first predetermined activity; and
decreasing the monitoring to the second level by removing monitoring for accesses that can be performed by the identified first predetermined activity.
5. The media of claim 1 , the operations further comprising:
scanning data associated with the first predetermined activity at a first level;
determining if the policy associated with the first predetermined activity indicates a second level of scanning; and
adjusting the scanning from the first level to the second level if indicated by the policy.
6. The media of claim 5 , the operations further comprising:
repeating the scanning, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.
7. The media of claim 5 , the operations further comprising:
determining if the data associated with the first predetermined activity includes unwanted data; and
performing one or more operations if the data includes unwanted data, wherein the one or more operations include at least one of: blocking activity associated with the data, quarantining the data, reporting the unwanted data, and logging the unwanted data.
8. The media of claim 5 , wherein adjusting the scanning from the first level to the second level if indicated by the policy includes at least one of:
increasing the scanning of a first subset of file operations for the first level to include a second set of file operations for the second level;
increasing the scanning of a first set of memory locations for the first level to include a second set of memory locations for the second level;
decreasing the scanning of a first subset of file operations for the first level to a reduced subset of file operations for the second level; and
decreasing the scanning of a first set of memory locations for the first level to a reduced subset of memory locations for the second level.
9. A system, comprising:
at least one memory element; and
at least one processor, the processor for performing operations associated with the system, including:
monitoring a first interface and a second interface at a first level for one or more predetermined activities associated with the second interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack and wherein the monitoring includes directly monitoring the first interface and indirectly monitoring the second interface;
identifying a first predetermined activity based on a callback for a calling code associated with the second interface, wherein the calling code is contained within the call frame of the call stack associated with the first interface, wherein the identifying includes unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the call stack;
determining if a policy associated with the first predetermined activity indicates a second level of monitoring; and
adjusting the monitoring from the first level to a second level if indicated by the policy.
10. The system of claim 9 , the operations further comprising:
repeating the monitoring, the identifying, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.
11. The system of claim 9 , wherein adjusting the monitoring from the first level to the second level includes at least one of:
increasing the monitoring to the second level by adding particular predetermined activities to the monitoring; and
decreasing the monitoring to the second level by removing particular predetermined activities from the monitoring.
12. The system of claim 9 , wherein adjusting the monitoring from the first level to the second level includes one of:
increasing the monitoring to the second level by adding monitoring for accesses that can be performed by the identified first predetermined activity; and
decreasing the monitoring to the second level by removing monitoring for accesses that can be performed by the identified first predetermined activity.
13. The system of claim 9 , the operations further comprising:
scanning data associated with the first predetermined activity at a first level;
determining if the policy associated with the first predetermined activity indicates a second level of scanning; and
adjusting the scanning from the first level to the second level if indicated by the policy.
14. The system of claim 13 , the operations further comprising:
repeating the scanning, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.
15. The system of claim 13 , the operations further comprising:
determining if the data associated with the first predetermined activity includes unwanted data; and
performing one or more operations if the data includes unwanted data, wherein the one or more operations include at least one of: blocking activity associated with the data, quarantining the data, reporting the unwanted data, and logging the unwanted data.
16. The system of claim 13 , wherein adjusting the scanning from the first level to the second level if indicated by the policy includes at least one of:
increasing the scanning of a first subset of file operations for the first level to include a second set of file operations for the second level;
increasing the scanning of a first set of memory locations for the first level to include a second set of memory locations for the second level;
decreasing the scanning of a first subset of file operations for the first level to a reduced subset of file operations for the second level; and
decreasing the scanning of a first set of memory locations for the first level to a reduced subset of memory locations for the second level.
17. A method, comprising:
monitoring a first interface and a second interface at a first level for one or more predetermined activities associated with the second interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack and wherein the monitoring includes directly monitoring the first interface and indirectly monitoring the second interface;
identifying a first predetermined activity based on a callback for a calling code associated with the second interface, wherein the calling code is contained within the call frame of the call stack associated with the first interface, wherein the identifying includes unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the call stack;
determining if a policy associated with the first predetermined activity indicates a second level of monitoring; and
adjusting the monitoring from the first level to a second level if indicated by the policy.
18. The method of claim 17 , further comprising:
repeating the monitoring, the identifying, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.
19. The method of claim 17 , further comprising:
scanning data associated with the first predetermined activity at a first level;
determining if the policy associated with the first predetermined activity indicates a second level of scanning; and
adjusting the scanning from the first level to the second level if indicated by the policy.
20. The method of claim 19 , further comprising:
determining if the data associated with the first predetermined activity includes unwanted data; and
performing one or more operations if the data includes unwanted data, wherein the one or more operations include at least one of: blocking activity associated with the data, quarantining the data, reporting the unwanted data, and logging the unwanted data.