Granted Patent B1

US 9,953,158 · App. 14/691,602 · Granted Apr 24, 2018

Abstract

Claims (68)

1. A computer-implemented method for enforcing secure software execution, the method being performed by a computing device comprising at least one processor, the method comprising:

providing a plurality of known benign inputs to an executable file that is susceptible to abnormal code execution;

observing a plurality of series of function calls made by the executable file as the executable file processes each of the known benign inputs in the plurality of known benign inputs;

storing the plurality of series of function calls as a plurality of control flow graphs that represents known safe function call pathways for the executable file, wherein each of the known safe function call pathways represents a safe order of function calls and each of the control flow graphs is associated with a file type description; and

forcing a subsequent execution of the executable file to follow a series of function calls in a safe order of function calls represented by a known safe function call pathway stored in one of the control flow graphs to protect the executable file against the abnormal code execution.

2. The method of claim 1 , wherein the forcing step further comprises:

monitoring, as part of a supervisor process that monitors the executable file, function calls issued by the executable file;

detecting, as part of the supervisor process, an errant function call issued by the executable file that does not follow the series of function calls stored in the one control flow graph; and

performing, as part of the supervisor process in response to detecting the errant function call, a security action to protect the executable file against the abnormal code execution.

3. The method of claim 2 , wherein performing the security action comprises at least one of:

blocking the errant function call issued by the executable file;

creating an entry in a security log that reports the errant function call issued by the executable file; and

terminating the subsequent execution of the executable file.

4. The method of claim 3 , wherein blocking the errant function call issued by the executable file comprises one of:

blocking the errant function call from resolving; and

returning an empty function in response to the errant function call.

5. The method of claim 2 , wherein performing the security action comprises:

obtaining verification from a user that the errant function call follows an expected series of function calls that is not stored in the one control flow graph; and

allowing, in response to receiving the verification, the errant function call.

6. The method of claim 1 , wherein the forcing step further comprises degrading the executable file.

7. The method of claim 6 , wherein:

the degrading step comprises generating a degraded executable file that is a copy of the executable file with at least one function of the executable file not represented in the one control flow graph having been degraded; and

the forcing step further comprises executing the degraded executable file in place of the executable file.

8. The method of claim 1 , wherein:

the providing step, the observing step, and the storing step are performed by a server; and

the forcing step comprises providing the one control flow graph to a client system that executes the subsequent execution of the executable file.

9. The method of claim 1 , wherein the forcing step further comprises:

determining that a type of an untested input provided to the subsequent execution of the executable file matches a file type associated with a particular control flow graph in the plurality of control flow graphs; and

using the particular control flow graph as the one control flow graph.

10. A system for enforcing secure software execution, the system comprising:

a providing module, stored in memory, that provides a plurality of known benign inputs to an executable file that is susceptible to abnormal code execution;

an observing module, stored in memory, that observes a plurality of series of function calls made by the executable file as the executable file processes each of the known benign inputs in the plurality of known benign inputs;

a storing module, stored in memory, that stores the plurality of series of function calls as a plurality of control flow graphs that represent known safe function call pathways for the executable file, wherein each of the known safe function call pathways represents a safe order of function calls and each of the control flow graphs is associated with a file type description;

a forcing module, stored in memory, that forces a subsequent execution of the executable file to follow a series of function calls in a safe order of function calls represented by a known safe function call pathway stored in one of the control flow graphs to protect the executable file against the abnormal code execution; and

at least one physical processor configured to execute the providing module, the observing module, the storing module, and the forcing module.

11. The system of claim 10 , wherein the forcing module forces the subsequent execution of the executable file to follow the series of function calls stored in the one control flow graph by:

monitoring, as part of a supervisor process that monitors the executable file, function calls issued by the executable file;

detecting, as part of the supervisor process, an errant function call issued by the executable file that does not follow the series of function calls stored in the one control flow graph; and

performing, as part of the supervisor process in response to detecting the errant function call, a security action to protect the executable file against the abnormal code execution.

12. The system of claim 11 , wherein the forcing module performs the security action by at least one of:

blocking the errant function call issued by the executable file;

creating an entry in a security log that reports the errant function call issued by the executable file; and

terminating the subsequent execution of the executable file.

13. The system of claim 12 , wherein the forcing module blocks the errant function call by one of:

blocking the errant function call from resolving; and

returning an empty function in response to the errant function call.

14. The system of claim 11 , wherein the forcing module performs the security action by:

obtaining verification from a user that the errant function call follows an expected series of function calls that is not stored in the one control flow graph; and

allowing, in response to receiving the verification, the errant function call.

15. The system of claim 10 , wherein the forcing module forces the subsequent execution of the executable file to follow the series of function calls stored in the one control flow graph by degrading the executable file.

16. The system of claim 15 , wherein the forcing module:

degrades the executable file by generating a degraded executable file that is a copy of the executable file with at least one function of the executable file not represented in the one control flow graph having been degraded; and

forces the subsequent execution of the executable file to follow the series of function calls stored in the one control flow graph further by executing the degraded executable file in place of the executable file.

17. The system of claim 10 , wherein:

the providing module, the observing module, and the storing module are executed by a server; and

the forcing module forces the subsequent execution of the executable file to follow the series of function calls stored in the one control flow graph by providing the one control flow graph to a client system that executes the subsequent execution of the executable file.

18. The system of claim 10 , wherein the forcing module forces the subsequent execution of the executable file to follow the series of function calls stored in the one control flow graph by:

determining that a type of an untested input provided to the subsequent execution of the executable file matches a file type associated with a particular control flow graph in the plurality of control flow graphs; and

using the particular control flow graph as the one control flow graph.

19. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

provide a plurality of known benign inputs to an executable file that is susceptible to abnormal code execution;

observe a plurality of series of function calls made by the executable file as the executable file processes each of the known benign inputs in the plurality of known benign inputs;

store the plurality of series of function calls as a plurality of control flow graphs that represents known safe function call pathways for the executable file, wherein each of the known safe function call pathways represents a safe order of function calls, and each of the control flow graphs is associated with a file type description; and

force a subsequent execution of the executable file to follow a series of function calls in a safe order of function calls represented by a known safe function call pathway stored in one of the control flow graphs to protect the executable file against the abnormal code execution.

20. The non-transitory computer-readable medium of claim 19 , wherein the one or more computer-readable instructions cause the computing device to force the subsequent execution of the executable file to follow the series of function calls stored in the one control flow graph by:

monitoring, as part of a supervisor process that monitors the executable file, function calls issued by the executable file;

detecting, as part of the supervisor process, an errant function call issued by the executable file that does not follow the series of function calls stored in the one control flow graph; and

performing, as part of the supervisor process in response to detecting the errant function call, a security action to protect the executable file against the abnormal code execution.

Assignments (6)