Data flow tracking via memory monitoring

1. A method of tracking data flows in a computing device, comprising:

monitoring memory to identify a read operation that reads information from a tainted memory address;

determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations;

monitoring operations until one of:

M operations are performed; and

N write operations to untainted addresses are identified;

marking memory addresses associated with identified write operations as tainted; and

marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted.

2. The method of claim 1 , further comprising using heuristics to identify the first, second and third number of operations.

3. The method of claim 1 , further comprising:

identifying a software application that reads information from one of the tainted memory addresses; and

applying behavior information collected in the computing device to boosted decision stumps in a classifier model to determine whether the software application is non-benign.

4. The method of claim 1 , further comprising:

identifying a first software application that reads information from one of the tainted memory addresses; and

monitoring application programming interface calls made by the first software application.

5. The method of claim 4 , further comprising:

generating a behavior vector information structure based on the monitored API calls;

applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and

using the behavior-based analysis results to determine whether the first software application is non-benign.

6. The method of claim 4 , further comprising:

identifying a second software application that reads information from one of the tainted memory addresses; and

monitoring application programming interface calls made by the second software application.

7. The method of claim 6 , further comprising:

generating a behavior vector information structure based on a combination of API calls made by the first and second software applications;

applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and

using the behavior-based analysis results to determine whether behavior of the first and second software applications is non-benign.

8. The method of claim 7 , wherein generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a collective behavior of the first and second software applications.

9. The method of claim 7 , wherein generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a relationship between the first and second software applications.

10. A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a computing device to perform operations comprising:

monitoring memory to identify a read operation that reads information from a tainted memory address;

determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations;

monitoring operations until one of:

M operations are performed; and

N write operations to untainted addresses are identified;

marking memory addresses associated with identified write operations as tainted; and

marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted.

11. The non-transitory computer readable storage medium of claim 10 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising using heuristics to identify the first, second and third number of operations.

12. The non-transitory computer readable storage medium of claim 10 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

identifying a software application that reads information from one of the tainted memory addresses; and

applying behavior information collected in the computing device to boosted decision stumps in a classifier model to determine whether the software application is non-benign.

13. The non-transitory computer readable storage medium of claim 10 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

identifying a first software application that reads information from one of the tainted memory addresses; and

monitoring application programming interface calls made by the first software application.

14. The non-transitory computer readable storage medium of claim 13 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

generating a behavior vector information structure based on the monitored API calls;

applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and

using the behavior-based analysis results to determine whether the first software application is non-benign.

15. The non-transitory computer readable storage medium of claim 13 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

identifying a second software application that reads information from one of the tainted memory addresses; and

monitoring application programming interface calls made by the second software application.

16. The non-transitory computer readable storage medium of claim 15 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising:

generating a behavior vector information structure based on a combination of API calls made by the first and second software applications;

applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and

using the behavior-based analysis results to determine whether behavior of the first and second software applications is non-benign.

17. The non-transitory computer readable storage medium of claim 16 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a collective behavior of the first and second software applications.

18. The non-transitory computer readable storage medium of claim 16 , wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a relationship between the first and second software applications.

19. A computing device, comprising:

a processor configured with processor-executable instructions to perform operations comprising:

monitoring memory to identify a read operation that reads information from a tainted memory address;

determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations;

monitoring operations until one of:

M operations are performed; and

N write operations to untainted addresses are identified;

marking memory addresses associated with identified write operations as tainted; and

marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted.

20. The computing device of claim 19 , wherein the processor is configured with processor-executable instructions to perform operations further comprising:

identifying a first software application that reads information from one of the tainted memory addresses;

monitoring application programming interface calls made by the first software application;

generating a behavior vector information structure based on the monitored API calls;

applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and

using the behavior-based analysis results to determine whether the first software application is non-benign.