Methods of identifying heap spray attacks using memory anomaly detection
View Patent ↗A non-transitory storage medium including instructions that are executable by one or more processors to perform operations including instrumenting a VM is shown. The VM is used to process an object to determine whether the object is associated with malware. Logic within the VM analyzes memory allocated for a process within the VM for a point of interest (POI), the POI being an address of one of a set predetermined instructions likely to be associated with malware. The VMM detects a memory violation during processing of the object and responsive to detecting the memory violation, injects a transition event at the POI on the page on which the POI is located in memory. Further, responsive to detecting an attempted execution of the transition event, the VMM (i) emulates an instruction located at the POI, and (ii) the logic within the VM performs one or more malware detection routines.
1. A non-transitory storage medium having stored thereon logic, the logic being executable by one or more processors to perform operations for heap spray detection including:
monitoring memory allocation for a process running during processing of an object;
responsive to detecting the memory allocation has exceeded a first memory threshold, determining whether (i) a memory region having a size greater than a second memory threshold being different than the first memory threshold has been allocated for the process, or (ii) at least a threshold number of memory regions having corresponding sizes has been allocated for the process;
selecting a subset of either (i) the memory region having a size greater than the second memory threshold or (ii) the memory regions having corresponding sizes; and
performing a similarity analysis on at least a portion of the selected subset, the similarity analysis to generate a similarity score based on a plurality of hash values associated with either portions of the subset of the memory region or the memory regions having corresponding sizes, the similarity score to indicate whether the object is associated with a heap spray attack.
2. The storage medium of claim 1 , wherein a corresponding size includes either (1) an exact same size wherein two memory regions include a same number of bytes, or (2) a size wherein a first number of bytes included in a first memory region is within a predetermined threshold of the number of bytes included in a second memory region.
3. The storage medium of claim 1 , wherein the processing of the object and monitoring of the memory allocation for the process is done in a virtual machine.
4. The storage medium of claim 1 , wherein the instructions being executable by the one or more processors to perform operations further including:
performing a data frequency analysis on at least a second portion of the selected subset to detect a repeating pattern.
5. The storage medium of claim 4 , wherein the performing of (i) the data frequency analysis and (ii) the similarity analysis occurs at least partially overlapping in time.
6. The storage medium of claim 1 , wherein the instructions being executable by the one or more processors to perform operations further including:
responsive to detecting the memory region having the size greater than the second memory threshold has been allocated for the process, dividing the memory region having the size greater than the second memory threshold into a plurality of smaller regions having a second same size.
7. The storage medium of claim 1 , wherein the selected subset includes a first grouping of the plurality of smaller regions.
8. The storage medium of claim 1 , wherein the instructions being executable by the one or more processors to perform operations further including:
responsive to the similarity score exceeding the score threshold, generating a report including information associated with the memory allocation for the process.
9. The storage medium of claim 1 , wherein the similarity analysis includes (i) performing a fuzzy hash to generate a hash list, and (ii) applying one or more similarity checks to one or more entries in the hash list.
10. A computerized method for detecting a heap spray attack, the method comprising:
monitoring memory allocation for a process running within a runtime environment established by a network device that is processing an object;
responsive to detecting the memory allocation has exceeded a first memory threshold, determining whether (i) a memory region having a size greater than a second memory threshold being different than the first memory threshold and allocated for the process, or (ii) at least a threshold number of memory regions having corresponding sizes has been allocated for the process;
selecting a subset of either (i) the memory region having a size greater than the second memory threshold or (ii) the memory regions having corresponding sizes; and
performing a similarity analysis on at least a portion of the selected subset, the similarity analysis to generate a similarity score based on a plurality of hash values associated with either portions of the subset of the memory region or the memory regions having corresponding sizes, the similarity score to indicate whether the object is associated with a heap spray attack.
11. The method of claim 10 , wherein a corresponding size includes either (1) an exact same size wherein two memory regions include a same number of bytes, or (2) a size wherein a first number of bytes included in a first memory region is within a predetermined threshold of the number of bytes included in a second memory region.
12. The method of claim 10 , wherein the processing of the object and monitoring of the memory allocation for the process is done in a virtual machine.
13. The method of claim 10 , further comprising:
performing a data frequency analysis on at least a second portion of the selected subset to detect a repeating pattern.
14. The method of claim 13 , wherein the performing of (i) the data frequency analysis and (ii) the similarity analysis occurs at least partially overlapping in time.
15. The method of claim 10 , wherein the instructions being executable by the one or more processors to perform operations further including:
responsive to detecting the memory region having the size greater than the second memory threshold has been allocated for the process, dividing the memory region having the size greater than the second memory threshold into a plurality of smaller regions having a second same size.
16. The method of claim 10 , wherein the selected subset includes a first grouping of the plurality of smaller regions.
17. The method of claim 10 , wherein the instructions being executable by the one or more processors to perform operations further including:
responsive to the similarity score exceeding the score threshold, generate a report including information associated with the memory allocation for the process.
18. The method of claim 10 , wherein the similarity analysis includes (i) performing a fuzzy hash to generate a hash list, and (ii) applying one or more similarity checks to one or more entries in the hash list.
19. An electronic device comprising:
one or more processors;
a storage device communicatively coupled to the one or more processors and storing logic, the logic being executable by the one or more processors to perform operations including:
monitoring memory allocation for a process running within a virtual machine that is processing an object;
responsive to detecting the memory allocation has exceeded a first memory threshold, determining whether (i) a memory region having a size greater than a second memory threshold different than the first memory threshold has been allocated for the process, or (ii) at least a threshold number of memory regions having corresponding sizes has been allocated for the process;
selecting a subset of either (i) the memory region having a size greater than the second memory threshold or (ii) the memory regions having corresponding sizes; and
performing a similarity analysis on at least a portion of the selected subset, the similarity analysis to generate a similarity score based on a plurality of hash values associated with either portions of the selected subset of the memory region or the memory regions having corresponding sizes, the similarity score to indicate whether the object is associated with a heap spray attack.
20. The electronic device of claim 19 , wherein a corresponding size includes either (1) an exact same size wherein two memory regions include a same number of bytes, or (2) a size wherein a first number of bytes included in a first memory region is within a predetermined threshold of the number of bytes included in a second memory region.
21. The electronic device of claim 19 , wherein the instructions being executable by the one or more processors to perform operations further including:
performing a data frequency analysis on at least a second portion of the selected subset to detect a repeating pattern.
22. The electronic device of claim 21 , wherein the performing of (i) the data frequency analysis and (ii) the similarity analysis occurs at least partially overlapping in time.
23. The electronic device of claim 19 , wherein the instructions being executable by the one or more processors to perform operations further including:
responsive to detecting the memory region having the size greater than the second memory threshold has been allocated for the process, dividing the memory region having the size greater than the second memory threshold into a plurality of smaller regions having a second same size.
24. The electronic device of claim 19 , wherein the selected subset includes a first grouping of the plurality of smaller regions.
25. The electronic device of claim 19 , wherein the instructions being executable by the one or more processors to perform operations further including:
responsive to the similarity score exceeding the score threshold, generating a report including information associated with the memory allocation for the process.
26. The electronic device of claim 19 , wherein the similarity analysis includes (i) performing a fuzzy hash to generate a hash list, and (ii) applying one or more similarity checks to one or more entries in the hash list.