Methods and apparatus for network detection of malicious data streams inside binary files

1. An apparatus comprising:

buffer size controller circuitry to divide data in a buffer into sections, the sections including a first section having a number of bytes of data;

sledge detector circuitry to determine that a first byte of data of the first section or a last byte of data of the first section is indicative of a memory address value;

a detection controller circuitry to:

identify a second section of the number of bytes of data in the buffer including a second byte of data indicative of a value within a preconfigured range, the preconfigured range corresponding to a range of values indicative of memory addresses;

update a merged list with a chunk of data that includes the second section having the second byte of data indicative of the value within the preconfigured range; and

reoccurrence detector circuitry to:

concatenate the chunk of data in the merged list into a string to identify a number of occurrences the string matches remaining data in the buffer; and

in response to a detection of the number of occurrences exceeding an occurrence threshold, determine that the data includes a malicious data stream.

2. The apparatus of claim 1 , wherein the detection controller circuitry is to iterate through the chunk of data in the buffer, the chunk of data corresponding to a number of sections of the number of bytes of data, the detection controller circuitry to analyze the number of sections in the chunk of data.

3. The apparatus of claim 1 , wherein the detection controller circuitry is to:

update a suspicious list with the second section including the second byte of data indicative of the value within the preconfigured range;

compare a length of the suspicious list with a threshold length; and

in response to the length of the suspicious list exceeding the threshold length:

concatenate the chunk of data in the merged list.

4. The apparatus of claim 1 , further including an output generator to terminate an input file when the malicious data stream is detected, the input file including the data in the buffer.

5. The apparatus of claim 1 , wherein the sledge detector circuitry is to:

in response to the first section having the first byte of data or the last byte of data indicative of the memory address value:

generate a threshold number of instances of the first section;

concatenate the threshold number of instances into a string of data; and

compare the string of data to subsequent sections of data in the buffer to identify a match between the string and subsequent data.

6. The apparatus of claim 5 , wherein the sledge detector circuitry is to remove the subsequent data in the buffer when the subsequent data matches the string of data.

7. The apparatus of claim 1 , further including a screening controller to determine an input file as susceptible to manipulation, the input file including the number of bytes of data in the buffer.

8. A non-transitory computer readable storage medium comprising instructions that, when executed, cause one or more processors to at least:

divide data in a buffer into sections, the sections including a first section having a number of bytes of data;

determine that a first byte of data of the first section or a last byte of data of the first section is indicative of a memory address value;

identify a second section of the number of bytes of data in the buffer including a second byte of data indicative of a value within a preconfigured range, the preconfigured range corresponding to a range of values indicative of memory addresses;

update a merged list with a chunk of data that includes the second section having the second byte of data indicative of the value within the preconfigured range;

concatenate the chunk of data in the merged list into a string to identify a number of occurrences the string matches remaining data in the buffer; and

determine that the data includes a malicious data stream when the number of occurrences exceeds an occurrence threshold.

9. The non-transitory computer readable storage medium of claim 8 , wherein the instructions, when executed, cause the one or more processors to iterate through the chunk of data in the buffer, the chunk of data corresponding to a number of sections of the number of bytes of data.

10. The non-transitory computer readable storage medium of claim 8 , wherein the instructions, when executed, cause the one or more processors to:

update a suspicious list with the second section including the second byte of data indicative of the value within the preconfigured range;

compare a length of the suspicious list with a threshold length; and

in response to the length of the suspicious list exceeding the threshold length:

concatenating the chunk of data in the merged list.

11. The non-transitory computer readable storage medium of claim 8 , wherein the instructions, when executed, cause the one or more processors to terminate an input file when the malicious data stream is detected, the input file including the data in the buffer.

12. The non-transitory computer readable storage medium of claim 8 , wherein the instructions, when executed, cause the one or more processors to:

in response to the first section having the first byte of data or the last byte of data indicative of the memory address value:

generate a threshold number of instances of the first section;

concatenate the threshold number of instances into a string of data; and

compare the string of data to subsequent sections of data in the buffer to identify a match between the string and subsequent data.

13. The non-transitory computer readable storage medium of claim 12 , wherein the instructions, when executed, cause the one or more processors to remove the subsequent data in the buffer when the subsequent data matches the string of data.

14. The non-transitory computer readable storage medium of claim 8 , wherein the instructions, when executed, cause the one or more processors to determine an input file as susceptible to manipulation, the input file including the number of bytes of data in the buffer.

15. A method comprising:

dividing data in a buffer into sections, the sections including a first section having a number of bytes of data;

determining that a first byte of data of the first section or a last byte of data of the first section is indicative of a memory address value;

identifying a second section of the number of bytes of data in the buffer including a second byte of data indicative of a value within a preconfigured range, the preconfigured range corresponding to a range of values indicative of memory addresses;

updating a merged list with a chunk of data that includes the second section having the second byte of data indicative of the value within the preconfigured range;

concatenating the chunk of data in the merged list into a string to identify a number of occurrences the string matches remaining data in the buffer; and

in response to a detection of the number of occurrences exceeding an occurrence threshold, determining that the data includes a malicious data stream.

16. The method of claim 15 , further including iterating through the chunk of data in the buffer, the chunk of data corresponding to a number of sections of the number of bytes of data.

17. The method of claim 15 , further including:

updating a suspicious list with the second section including the second byte of data indicative of the value within the preconfigured range;

comparing a length of the suspicious list with a threshold length; and

in response to the length of the suspicious list exceeding the threshold length:

concatenating the chunk of data in the merged list.

18. The method of claim 15 , further including terminating an input file when the malicious data stream is detected, the input file including the data in the buffer.

19. The method of claim 15 , further including:

in response to the first section having the first byte of data or the last byte of data indicative of the memory address value:

generating a threshold number of instances of the first section;

concatenating the threshold number of instances into a string of data; and

comparing the string of data to subsequent sections of data in the buffer to identify a match between the string and subsequent data.

20. The method of claim 19 , further including removing the subsequent data in the buffer when the subsequent data matches the string of data.

21. A server to distribute first software on a network, the server comprising:

at least one storage device including second instructions; and

at least one microprocessor to execute the second instructions to transmit first instructions over the network, the first instructions, when executed, to cause at least one device to:

identify an incoming file as a first open data file or a second open data file, the first or second open data file susceptible to manipulation;

remove a sledge of data in the incoming file identified as the first or second open data file, the sledge of data corresponding to a sequence of repetitive data;

analyze remaining data in the incoming file for one or more bytes of data indicative of a memory address value; and

detect a sequence of the one or more bytes of data indicative of the memory address value as a malicious data stream.