Granted Patent B1

US 10,210,329 · App. 14/871,987 · Granted Feb 19, 2019

Abstract

Claims (43)

1. An electronic device, comprising:

one or more hardware processors; and

a non-transitory computer-readable storage medium communicatively coupled to the one or more hardware processors, the non-transitory computer-readable storage medium having stored thereon logic that, upon execution by the one or more hardware processors, performs operations comprising:

identifying a loaded module,

applying a protection mechanism to an element of the loaded module so as to establish a protected region, wherein the element of the loaded module is one of a base address of the loaded module, an import table of the loaded module or a process environment block of the loaded module,

determining whether an access source is attempting to access the protected region,

determining whether the access source is from the heap, and

determining the access source is malicious based on determining the access source is attempting to access the protected region and is from the heap.

2. The electronic device of claim 1 , wherein the execution by the one or more hardware processors performs operations further comprising generating an alert so as to notify a user or a network administrator of a probable application-execution hijacking attack.

3. The electronic device of claim 1 , wherein the execution by the one or more processors performs operations further comprising terminating the loaded module so as to prevent an application-execution hijacking attack.

4. The electronic device of claim 1 , wherein the execution by the one or more processors performs operations further comprising generating a log file.

5. The electronic device of claim 1 , wherein the loaded module includes executable code.

6. An electronic device, comprising:

one or more hardware processors; and

a non-transitory computer-readable storage medium communicatively coupled to the one or more hardware processors, the non-transitory computer-readable storage medium having stored thereon logic that, upon execution by the one or more hardware processors, performs operations comprising:

identifying a loaded module,

applying a protection mechanism to an import table of the loaded module so as to establish a protected region,

determining whether an access source is attempting to access the protected region,

determining whether the access source is from the heap,

determining whether the access source is from the loaded module and accessing its own import address table, and

determining the access source is malicious based on determining the access source is (i) attempting to access the protected region, (ii) from the heap, and (iii) accessing its own import address table.

7. The electronic device of claim 5 , wherein the loaded module comprises one or more dynamic-link libraries (DLLs) that provide a scripting environment to applications.

8. The electronic device of claim 6 , wherein the loaded module includes executable code.

9. A system comprising:

a dynamic analysis server comprising one or more hardware processors, a non-transitory computer-readable storage medium and one or more virtual machines that are configured to execute event logic with respect to a loaded module, wherein the one or more virtual machines are communicatively coupled to a virtual machine manager and a database;

rule-matching logic comprising detection logic configured to be executable by the one or more hardware processors to determine whether (1) an access source is attempting to access a protected region, and (2) the access source is from the heap; and

reporting logic comprising alert generating logic that is configured to generate an alert so as to notify a user or a network administrator of a probable application-execution hijacking attack.

10. The system of claim 7 , further comprising process handling logic that is configured to terminate a potentially malicious loaded module.

11. The system of claim 7 , wherein the detection logic is configured to determine whether a protected page is being accessed, and whether the access source is from the heap.

12. The system of claim 9 , wherein the detection logic is configured to determine whether the loaded module is accessing its own import table.

13. The system of claim 9 , wherein the loaded module includes executable code.

14. The system of claim 9 , wherein further comprising dynamic-link library (DLL)/kernel logic that modularizes a software program into separate components.

15. A system comprising:

a mobile device configured to execute a malware detection application thereon, the detection application comprising:

exploit detection logic configured to execute certain event logic with respect to a loaded module;

rule-matching logic comprising detection logic configured to determine whether an access source is attempting to access a protected region and determine whether the access source is from the heap;

reporting logic comprising alert generating logic that is configured to generate an alert; and

user interface logic that is configured to notify a user or a network administrator of a probable application-execution hijacking attack.

16. The system of claim 11 , wherein the exploit detection logic is configured to terminate the loaded module.

17. The system of claim 11 , wherein the exploit detection logic is configured to generate an alert.

18. The system of claim 15 , further comprising process handling logic that is configured to terminate a potentially malicious loaded module.

19. The system of claim 15 , wherein the loaded module includes executable code.

20. The system of claim 15 , wherein further comprising dynamic-link library (DLL)/kernel logic that modularizes a software program into separate components.

Assignments (13)

Cited By (22)

US 12,200,006 US 12,200,013 US 12,223,060 US 12,223,337 US 12,248,563 US 12,273,367 US 12,278,834 US 12,282,564 US 12,335,297 US 12,348,485 US 12,348,561 US 12,353,563 US 12,363,145 US 12,388,865 US 12,425,437 US 12,445,458 US 12,445,481 US 12,462,016 US 12,481,765 US 12,587,555 US 12,639,438 US 12,647,433