Exploit detection via induced exceptions
Examples of the present disclosure describe systems and methods for exploit detection via induced exceptions. One embodiment of a method can include generating an inspection point, the inspection point causing an exception when a set of software instructions encounters the inspection point during an execution of the set of software instructions by a processor, registering an exception handler to handle the exception associated with by the inspection point; receiving, in response to the set of software instructions encountering the inspection point, an indication of an exception, accessing a context record associated with the execution of the set of software instructions, evaluating the context record to determine if an exploit is present using the first reputation information, and based on a determination that an exploit is present, performing a corrective action for the exploit.
1. A system comprising:
a reputation data store storing reputation information;
a processor; and
a memory storing instructions executable by the processor, wherein the instructions executable by the processor comprise instructions for:
generating an inspection point, the inspection point causing an exception when a set of software instructions encounters the inspection point during an execution of the set of software instructions by the processor;
registering an exception handler to handle the exception associated with by the inspection point;
receiving, in response to the set of software instructions encountering the inspection point, an indication of the exception;
based on the indication of the exception, accessing a context record associated with the execution of the set of software instructions;
accessing reputation information from the reputation data store;
evaluating the context record to determine if an exploit is present, wherein evaluating the context record comprises evaluating the context record using the reputation information; and
based on a determination that the exploit is present, performing a corrective action for the exploit.
2. The system of claim 1 , wherein generating the inspection point comprises altering an application programming interface to incorporate a first instruction that will generate the exception.
3. The system of claim 2 , wherein the instructions executable by the processor comprise instructions for altering the application programming interface to incorporate a second instruction that comprises an identifier for the inspection point.
4. The system of claim 1 , wherein generating the inspection point comprises setting a process breakpoint at the processor to generate the exception.
5. The system of claim 1 , wherein generating the inspection point comprises setting a hardware breakpoint at the processor to generate the exception.
6. The system of claim 1 , wherein generating the inspection point comprises altering a permission on a memory page to cause the exception to occur when the set of software instructions accesses the memory page.
7. The system of claim 1 , wherein the context record comprises a recorded state of register values when the exception occurred and a call stack associated with the execution of the set of software instructions, and wherein evaluating the context record comprises evaluating the call stack for a return on programming exploit and evaluating the call stack for a stack pivot exploit.
8. The system of claim 1 , wherein the reputation information includes a description of a threat and information relating to the corrective action.
9. A method for exploit detection using an induced exception, comprising:
generating an inspection point, the inspection point causing an exception when a set of software instructions encounters the inspection point during an execution of the set of software instructions by a processor;
registering an exception handler to handle the exception associated with by the inspection point;
receiving, in response to the set of software instructions encountering the inspection point, an indication of the exception;
based on the indication of the exception, accessing a context record associated with the execution of the set of software instructions;
accessing reputation information from a reputation data store;
evaluating the context record to determine if an exploit is present, wherein evaluating the context record comprises evaluating the context record using the reputation information; and
based on a determination that the exploit is present, performing a corrective action for the exploit.
10. The method of claim 9 , wherein generating the inspection point comprises altering an application programming interface to incorporate a first instruction that will generate the exception.
11. The method of claim 10 , further comprising altering the application programming interface to incorporate a second instruction that comprises an identifier for the inspection point.
12. The method of claim 9 , wherein generating the inspection point comprises setting a process breakpoint at the processor to generate the exception.
13. The method of claim 9 , wherein generating the inspection point comprises setting a hardware breakpoint at the processor to generate the exception.
14. The method of claim 9 , wherein generating the inspection point comprises altering a permission on a memory page to cause the exception to occur when the set of software instructions accesses the memory page.
15. The method of claim 9 , wherein the context record comprises a recorded state of register values when the exception occurred and a call stack associated with the execution of the set of software instructions, and wherein evaluating the context record comprises evaluating the call stack for a return on programming exploit and evaluating the call stack for a stack pivot exploit.
16. The method of claim 9 , wherein the reputation information includes a description of a threat and information relating to the corrective action.
17. A computer program product comprising a non-transitory, computer-readable medium storing thereon a set of computer instructions executable by a processor for exploit detection, the set of computer instructions comprising instructions for:
generating an inspection point, the inspection point causing an exception when a set of software instructions encounters the inspection point during an execution of the set of software instructions by the processor;
registering an exception handler to handle the exception associated with by the inspection point;
receiving, in response to the set of software instructions encountering the inspection point, an indication of the exception;
based on the indication of the exception, accessing a context record associated with the execution of the set of software instructions;
accessing reputation information from a reputation data store;
evaluating the context record to determine if an exploit is present, wherein evaluating the context record comprises evaluating the context record using the reputation information; and
based on a determination that the exploit is present, performing a corrective action for the exploit.
18. The computer program product of claim 17 , wherein generating the inspection point comprises altering an application programming interface to incorporate a first instruction that will generate the exception.
19. The computer program product of claim 18 , the set of computer instructions further comprises instructions for altering the application programming interface to incorporate a second instruction that comprises an identifier for the inspection point.
20. The computer program product of claim 17 , wherein generating the inspection point comprises setting a process breakpoint at the processor to generate the exception.
21. The computer program product of claim 17 , wherein generating the inspection point comprises setting a hardware breakpoint at the processor to generate the exception.
22. The computer program product of claim 17 , wherein generating the inspection point comprises altering a permission on a memory page to cause the exception to occur when the set of software instructions accesses the memory page.
23. The computer program product of claim 17 , wherein the context record comprises a recorded state of register values when the exception occurred and a call stack associated with the execution of the set of software instructions, and wherein evaluating the context record comprises evaluating the call stack for a return on programming exploit and evaluating the call stack for a stack pivot exploit.
24. The computer program product of claim 17 , wherein the reputation information includes a description of a threat and information relating to the corrective action.