Granted Patent B2

US 12,625,962 · App. 17/743,945 · Granted May 12, 2026

Inventor: Phani Bhushan Avadhanam (San Diego, CA)

Assignee: Oracle International Corporation

G06F21/568G06F21/552G06F21/554G06F21/564G06F21/577

Abstract

Claims (103)

1 . A computer-implemented method, comprising:

during hardware-based execution of at least one instruction in a set of instructions in an instruction cache accessible by a hardware processor, executing a monitoring operation to monitor the instruction cache;

detecting a modification of a mapping of a first memory location to a cache location within the instruction cache;

based at least on detecting the modification of the mapping, triggering a validation operation for validating one or more instructions of the set of instructions in the instruction cache;

causing execution of the validation operation for validating the one or more instructions of the set of instructions in the instruction cache, wherein executing the validation operation comprises:

collecting a metric associated with the one or more instructions of the set of instructions in the instruction cache; and

determining a likelihood of a ransomware attack based on the metric; and

transmitting a first notification based on the likelihood of the ransomware attack.

2 . The computer-implemented method of claim 1 , wherein the method further comprises:

detecting an instruction class of a first instruction stored in the instruction cache;

determining a frequency of instances of the first instruction in the instruction cache;

assigning a weight to the first instruction based at least in part on the instruction class; and

determining the likelihood of the ransomware attack based at least in part on the weight.

3 . The computer-implemented method of claim 1 , wherein the method further comprises:

generating a first cryptographic bitmap comprising a first row of encryption related data associated with the instruction cache, and generating a second cryptographic bitmap comprising a second row of encryption related data associated with the instruction cache, wherein the first row is associated with a first instruction of the one or more instructions;

performing, on the first row and the second row, a mathematical exclusive operation to derive a delta value;

comparing derived delta value to a threshold delta value; and

determining whether the likelihood of the ransomware attack is a false positive based on the comparing.

4 . The computer-implemented method of claim 1 , wherein the method further comprises registering a callback function, and wherein the first notification is transmitted using the callback function.

5 . The computer-implemented method of claim 1 , wherein the method further comprises receiving a second notification that an instance has been repaved based at least in part on the determination of the likelihood of the ransomware attack.

6 . The method of claim 1 , wherein the operations further comprise:

determining that modifications to the mapping exceed a threshold number of modifications, wherein executing the validation instruction is responsive to determining that the modifications to the mapping exceed a threshold number of modifications.

7 . The method of claim 1 , wherein:

the one or more instructions comprise assembly instructions related to encryption; and

determining the likelihood of the ransomware attack based on the metric comprises determining that one or more of the assembly instructions exceed a threshold.

8 . The method of claim 1 , wherein determining the likelihood of the ransomware attack based on the metric comprises:

assigning each instruction of the one or more instructions to one of a plurality of instruction classes based on a respective instruction type of the one or more instructions;

determining a weighted frequency of each instruction class using weights respectively associated with the plurality of instruction classes; and

determining the likelihood of the ransomware attack based on a sum of the weighted frequencies exceeding a threshold.

9 . The method of claim 1 , wherein the modification of the mapping of the instruction cache location, within the instruction cache, to the first memory location is performed prior to executing the operation stored at the first memory location.

10 . The computer-implemented method of claim 1 , wherein:

the metric is indicative of encryption instruction types; and

determining the likelihood of a ransomware attack comprises:

determining, based on the metric, a first frequency of instances of a first encryption instruction type included in the one or more instructions in the instruction cache;

assigning a first weight to the first frequency of instances based on the first encryption instruction type;

determining, based on the metric, a second frequency of instances of a second encryption instruction type included in the one or more instructions in the instruction cache;

assigning a second weight to the second frequency of instances based on the second encryption instruction type; and

determining the likelihood of the ransomware attack based at least in part on (a) a combination of the first weight and the first frequency, and (b) a combination of the second weight and the second frequency.

11 . A cloud infrastructure node, comprising:

a processor; and

a computer-readable medium including instructions that, when executed by the processor, cause the processor to:

during hardware-based execution of at least one instruction in a set of instructions in an instruction cache accessible by a hardware processor, execute a monitoring operation to monitor the instruction cache;

detect a modification of a mapping of a first memory location to a cache location within the instruction cache;

based at least on detecting the modification of the mapping, trigger a validation operation for validating one or more instructions of the set of instructions in the instruction cache;

cause execution of the validation operation for validating the one or more of the set of instructions in the instruction cache, wherein executing the validation operation comprises:

collecting a metric associated with the one or more instructions of the set of instructions in the instruction cache; and

determining a likelihood of a ransomware attack based at least in part on the metric; and

transmit a first notification of the likelihood of the ransomware attack.

12 . The cloud infrastructure node of claim 11 , wherein the instructions included in the computer-readable medium further cause the processor to:

detect an instruction class of a first instruction stored in the instruction cache;

determine a frequency of instances of the first instruction in the instruction cache;

assign a weight to the first instruction based at least in part on the instruction class; and

determine the likelihood of the ransomware attack based at least in part on the weight.

13 . The cloud infrastructure node of claim 11 , wherein the instructions included in the computer-readable medium further cause the processor to:

generate a first cryptographic bitmap comprising a first row of encryption related data associated with the instruction cache, and generating a second cryptographic bitmap comprising a second row of encryption related data associated with the instruction cache, wherein the first row is associated with a first instruction of the one or more instructions;

perform, on the first row and the second row, a mathematical exclusive operation to derive a delta value;

compare derived delta value to a threshold delta value; and

determine whether the likelihood of the ransomware attack is a false positive based on the comparing.

14 . The cloud infrastructure node of claim 11 , wherein the instructions included in the computer-readable medium further cause the processor to register a callback function, and wherein the first notification is transmitted using the callback function.

15 . The cloud infrastructure node of claim 11 , wherein the instructions included in the computer-readable medium further cause the processor to receive a second notification that an instance has been repaved based at least in part on the determination of the likelihood of the ransomware attack.

16 . The cloud infrastructure node of claim 11 , wherein the operations further comprise:

determining that modifications to the mapping exceed a threshold number of modifications, wherein executing the validation instruction is responsive to determining that the modifications to the mapping exceed a threshold number of modifications.

17 . The cloud infrastructure node of claim 11 , wherein:

the one or more instructions comprise assembly instructions related to encryption; and

determining the likelihood of the ransomware attack based on the metric comprises determining that one or more of the assembly instructions exceed a threshold.

18 . The cloud infrastructure node of claim 11 , wherein determining the likelihood of the ransomware attack based on the metric comprises:

assigning each instruction of the one or more instructions to one of a plurality of instruction classes based on a respective instruction type of the one or more instructions;

determining a weighted frequency of each instruction class using weights respectively associated with the plurality of instruction classes; and

determining the likelihood of the ransomware attack based on a sum of the weighted frequencies exceeding a threshold.

19 . The cloud infrastructure node of claim 11 , wherein the modification of the mapping of the instruction cache location, within the instruction cache, to the first memory location is performed prior to executing the operation stored at the first memory location.

20 . A non-transitory computer-readable medium including stored thereon a sequence of instructions that, when executed by a processor of a cloud infrastructure node, causes the processor to perform operations comprising:

during hardware-based execution of at least one instruction in a set of instructions in an instruction cache accessible by a hardware processor, executing a monitoring operation to monitor the instruction cache;

detecting a modification of a mapping of a first memory location to a cache location within the instruction cache;

based at least on detecting the modification of the mapping, triggering a validation operation for validating one or more instructions of the set of instructions in the instruction cache;

causing execution of the validation operation for validating the one or more instructions of the set of instructions in the instruction cache, wherein executing the validation operation comprises:

collecting a metric associated with the one or more instructions of the set of instructions in the instruction cache; and

determining a likelihood of a ransomware attack based on the metric; and

transmitting a notification based on the likelihood of the ransomware attack.

21 . The non-transitory computer-readable medium of claim 20 ,

wherein the operations further comprise:

detecting an instruction class of a first instruction stored in the instruction cache;

determining a frequency of instances of the first instruction in the instruction cache;

assigning a weight to the first instruction based at least in part on the class; and

determining the likelihood of the ransomware attack based at least in part on the weight.

22 . The non-transitory computer-readable medium of claim 20 ,

wherein the operations further comprise:

generating a first cryptographic bitmap comprising a first row of encryption related data associated with the instruction cache, and generating a second cryptographic bitmap comprising a second row of encryption related data associated with the instruction cache, wherein the first row is associated with a first instruction of the one or more instructions;

performing, on the first row and the second row, a mathematical exclusive operation to derive a delta value;

comparing derived delta value to a threshold delta value; and

determining whether the likelihood of the ransomware attack is a false positive based on the comparing.

23 . The non-transitory computer-readable medium of claim 20 , wherein the operations further comprise registering a callback function, and wherein the notification is transmitted using the callback function.

24 . The non-transitory computer-readable medium of claim 20 ,

wherein the operations further comprise:

determining that modifications to the mapping exceed a threshold number of modifications, wherein executing the validation instruction is responsive to determining that the modifications to the mapping exceed a threshold number of modifications.

25 . The non-transitory computer-readable medium of claim 20 , wherein:

the one or more instructions comprise assembly instructions related to encryption; and

determining the likelihood of the ransomware attack based on the metric comprises determining that one or more of the assembly instructions exceed a threshold.

26 . The non-transitory computer-readable medium of claim 20 ,

wherein determining the likelihood of the ransomware attack based on the metric comprises:

assigning each instruction of the one or more instructions to one of a plurality of instruction classes based on a respective instruction type of the one or more instructions;

determining a weighted frequency of each instruction class using weights respectively associated with the plurality of instruction classes; and

determining the likelihood of the ransomware attack based on a sum of the weighted frequencies exceeding a threshold.

27 . The non-transitory computer-readable medium of claim 20 , wherein the modification of the mapping of the instruction cache location, within the instruction cache, to the first memory location is performed prior to executing the operation stored at the first memory location.

Assignments (1)

Continuity (1)

References Cited (19)