Non-invasive program execution protection

1. A method for use in a computing device having a processor, the method comprising:

executing a computer program on the processor;

while the computer program is running, detecting whether any transition instructions of a plurality of transition instructions of the computer program is executed, wherein the detecting is performed by using resources that are external to the computer program;

in response to detecting that a given transition instruction of the plurality of transition instructions of the computer program is executed, retrieving a current value of a memory location associated with the computer program;

detecting whether the current value of the memory location associated with the computer program matches one or more expected values for the memory location associated with the computer program that correspond to the given transition instruction, wherein the one or more expected values for the memory location associated with the computer program are identified based on a data record, and wherein the data record maps each transition instruction of the plurality of transition instructions of the computer program to one or more respective values, which the memory location associated with the computer program is expected to have when the transition instruction of the plurality of transition instructions of the computer program is executed; and

performing a countermeasure action when the current value of the memory location associated with the computer program does not match the one or more expected values for the memory location associated with the computer program.

2. The method of claim 1 , wherein performing the countermeasure action includes at least one of stopping an execution of the computer program, outputting an alert, and generating a log entry that indicates a presence of an anomaly in the execution of the computer program.

3. The method of claim 1 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring an operating system call stack to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

4. The method of claim 1 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring trace packets that are provided by the processor to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

5. The method of claim 1 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring an instruction pointer register of the processor to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

6. The method of claim 1 , further comprising detecting whether a current execution flow of the computer program matches a control flow graph for the computer program when the given transition instruction of the plurality of transition instructions of the computer program is executed, wherein the countermeasure action is performed further based on a mismatch of the current execution flow of the computer program and the control flow graph for the computer program, and wherein the control flow graph for the computer program is generated by simulating an execution of the computer program.

7. The method of claim 6 , wherein the current execution flow of the computer program includes one or more transition instructions of the computer program that have been executed prior to the given transition instruction of the plurality of transition instructions of the computer program.

8. A system, comprising:

a memory; and

a processor operatively coupled to the memory, the processor being configured to perform the operations of:

executing a computer program on the processor;

while the computer program is running, detecting whether any transition instructions of a plurality of transition instructions of the computer program is executed, wherein the detecting is performed by using resources that are external to the computer program;

in response to detecting that a given transition instruction of the plurality of transition instructions of the computer program is executed, retrieving a current value of a memory location associated with the computer program;

detecting whether the current value of the memory location associated with the computer program matches one or more expected values for the memory location associated with the computer program that correspond to the given transition instruction, wherein the one or more expected values for the memory location associated with the computer program are identified based on a data record, and wherein the data record maps each transition instruction of the plurality of transition instructions of the computer program to one or more respective values, which the memory location associated with the computer program is expected to have when the transition instruction of the plurality of transition instructions of the computer program is executed; and

performing a countermeasure action when the current value of the memory location associated with the computer program does not match the one or more expected values for the memory location associated with the computer program.

9. The system of claim 8 , wherein performing the countermeasure action includes at least one of stopping an execution of the computer program, outputting an alert, and generating a log entry that indicates a presence of an anomaly in the execution of the computer program.

10. The system of claim 8 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring an operating system call stack to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

11. The system of claim 8 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring trace packets that are provided by the processor to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

12. The system of claim 8 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring an instruction pointer register of the processor to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

13. The system of claim 8 , further comprising detecting whether a current execution flow of the computer program matches a control flow graph for the computer program when the given transition instruction of the plurality of transition instructions of the computer program is executed, wherein the countermeasure action is performed further based on a mismatch of the current execution flow of the computer program and the control flow graph for the computer program, and wherein the control flow graph for the computer program is generated by simulating an execution of the computer program.

14. The system of claim 13 , wherein the current execution flow of the computer program includes one or more transition instructions of the computer program that have been executed prior to the given transition instruction of the plurality of transition instructions of the computer program.

15. A non-transitory computer-readable medium storing one or more processor-executable instructions, which when executed by a processor, cause the processor to perform the operations of:

executing a computer program on the processor;

while the computer program is running, detecting whether any transition instructions of a plurality of transition instructions of the computer program is executed, wherein the detecting is performed by using resources that are external to the computer program;

in response to detecting that a given transition instruction of the plurality of transition instructions of the computer program is executed, retrieving a current value of a memory location associated with the computer program;

detecting whether the current value of the memory location associated with the computer program matches one or more expected values for the memory location associated with the computer program that correspond to the given transition instruction, wherein the one or more expected values for the memory location associated with the computer program are identified based on a data record, and wherein the data record maps each transition instruction of the plurality of transition instructions of the computer program to one or more respective values, which the memory location associated with the computer program is expected to have when the transition instruction of the plurality of transition instructions of the computer program is executed; and

performing a countermeasure action when the current value of the memory location associated with the computer program does not match the one or more expected values for the memory location associated with the computer program.

16. The non-transitory computer-readable medium of claim 15 , wherein performing the countermeasure action includes at least one of stopping an execution of the computer program, outputting an alert, and generating a log entry that indicates a presence of an anomaly in the execution of the computer program.

17. The non-transitory computer-readable medium of claim 15 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring an operating system call stack to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

18. The non-transitory computer-readable medium of claim 15 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring trace packets that are provided by the processor to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

19. The non-transitory computer-readable medium of claim 15 , wherein detecting whether any transition instructions of the plurality of transition instructions of the computer program is executed includes monitoring an instruction pointer register of the processor to detect execution of any transition instructions of the plurality of transition instructions of the computer program.

20. The non-transitory computer-readable medium of claim 15 , further comprising detecting whether a current execution flow of the computer program matches a control flow graph for the computer program when the given transition instruction of the plurality of transition instructions of the computer program is executed, wherein the countermeasure action is performed further based on a mismatch of the current execution flow of the computer program and the control flow graph for the computer program, and wherein the control flow graph for the computer program is generated by simulating an execution of the computer program.