Detecting software attacks on processes in computing devices

A computing device, comprising:

• a memory comprising a plurality of virtual memory regions;
• and
• a processor coupled to the memory and configured with processor-executable instructions to:
• monitor structural attributes of the plurality of virtual memory regions utilized by a process executing on the computing device, wherein the monitored structural attributes include how many virtual memory regions are utilized by the process;
• generating a vector data-structure that includes a series of numbers, wherein each number signifies a partial or complete representation of data collected via the monitoring;
• compare the monitored structural attributes to expected structural attributes of the plurality of virtual memory regions by applying the generated vector data-structure to a classifier model;
• and
• determine whether the monitored structural attributes represent anomalous behavior of the process based on a result of applying the generated vector data-structure to the classifier model.

A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a computing device to perform operations comprising:

• monitoring structural attributes of a plurality of virtual memory regions utilized by a process executing on the computing device, wherein the monitored structural attributes include how many virtual memory regions are utilized by the process;
• generating a vector data-structure that includes a series of numbers, wherein each number signifies a partial or complete representation of data collected via the monitoring;
• comparing the monitored structural attributes to expected structural attributes of the plurality of virtual memory regions by applying the generated vector data-structure to a classifier model;
• and
• determining whether the monitored structural attributes represent anomalous behavior of the process based on a result of applying the generated vector data-structure to the classifier model.

A computing device, comprising:

• means for monitoring structural attributes of a plurality of virtual memory regions utilized by a process executing on the computing device, wherein the monitored structural attributes include how many virtual memory regions are utilized by the process;
• means for generating a vector data-structure that includes a series of numbers, wherein each number signifies a partial or complete representation of data collected via the monitoring;
• means for comparing the monitored structural attributes to expected structural attributes of the plurality of virtual memory regions comprising means for applying the generated vector data-structure to a classifier model;
• and
• means for determining whether the monitored structural attributes represent anomalous behavior of the process based on a result of applying the generated vector data-structure to the classifier model.