US 10,372,905 B1Granted

Preventing unauthorized software execution

AssigneeAmazon Technologies, Inc.

InventorsJon Arron McClintock, Darren Ernest Canavor, George Nikolaos Stathakopoulos

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques are described for preventing a software module from executing in an unauthorized environment. A software module may be configured to collect context information that describes an environment in which the software module is executing. If the context information indicates that the environment is unauthorized for executing the software module, the software module may alter its behavior(s) or its binary signature to simulate a threat. Threat detection module(s), such as anti-virus software, anti-malware software, and so forth, may then identify the software module as a threat and disable its execution or perform other actions. In some cases, the analysis of the context information may be performed on server device(s), which may send a signal to cause the software module to alter its behavior(s) or its binary signature.

Claims20

Dependent claims

A computer-implemented method, comprising:

during execution of a software module on a host device, collecting context information indicative of:
network information describing at least one network that is accessible by the software module;
accessible device information describing at least one other device that is accessible by the software module;
a configuration of the software module, and
a configuration of the host device;
comparing the context information collected during execution of the software module to context information known to be associated with an environment authorized for execution of the software module;
based on the comparing the context information collected during execution of the software module to the context information known to be associated with the environment authorized for execution of the software module, determining that the software module is executing in an environment unauthorized for execution of the software module;
upon determining the software module is executing in an environment unauthorized for execution of the software module, executing defensive instructions that are included in the software module to alter the software module to simulate a threat, the altering of the software module including one or more of:
modifying at least a portion of a signature of the software module to correspond to at least a portion of a threat signature of the threat that is detectable by a threat detection module;
and
modifying at least one behavior of the software module to correspond to a threat behavior of the threat that is detectable by the threat detection module;
upon executing the defensive instructions, identifying the software module as the threat by the threat detection module;
and
disabling the execution of the software module on the host device based on the software module being identified as the threat.

11 more elements

A system, comprising:

at least one computing device configured to implement one or more services, the one or more services configured to:
access context information describing an environment in which a software module is executing on a host device, the software module including one or more defensive instructions, wherein the environment in which the software module is executing on the host device comprises one or more of:
at least network information describing at least one network that is accessible by the software module executing on a host device;
or
accessible devices information describing at least one other device that is accessible by the software module;
compare the accessed context information describing the environment in which the software module is executing on the host device to context information known to be associated with an environment authorized for execution of the software module;
based on comparing the accessed context information describing the environment in which the software module is executing on the host device to the context information known to be associated with the environment authorized for execution of the software module, determine that the host device is included in an environment that is unauthorized for executing the software module;
upon determining the host device is included in an environment that is unauthorized for executing the software module, send, to the software module, a signal configured to cause the one or more defensive instructions included in the software module to alter the software module to execute one or more additional executable instructions that simulate a threat;
identify, by a threat detection module, that the software module is simulating the threat;
and
disable the execution of the software module on the host device based on the software module being identified as the threat.

8 more elements

One or more non-transitory computer-readable media storing instructions which, when executed by at least one processor, instructs the at least one processor to:

determine context information describing an environment in which a software module is executing on a host device, wherein the environment comprises one or more of:
network information describing at least one network that is accessible from the host device, or
accessible device information describing at least one other device that is accessible from the host device;
compare the determined context information describing the environment in which the software module is executing on the host device to context information known to be associated with an environment authorized for execution of the software module;
based on comparing the determined context information describing the environment in which the software module is executing on the host device to the context information known to be associated with the environment authorized for execution of the software module, determine that the host device is included in an environment that is unauthorized for executing the software module;
and
upon determining the host device is included in an environment that is unauthorized for executing the software module, alter the software module to simulate a threat identified by a threat detection module as the threat and cause the threat detection module to perform actions to disable the execution of the software module on the host device, wherein the altering of the software module includes at least executing one or more additional executable instructions included in the software module that correspond to the threat.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/569,265Filed 12 Dec 2014
Granted: 6 Aug 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
G06F 21/566
Computer malware detection or handling, e.g. anti-virus arrangements: dynamic detection, i.e. detection performed at run-time, e.g. emulation,…
G06F 2221/033
Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms: test or assess software
G06F
Computing and data processing

Family

No related US applications are recorded in the indexed filing history.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key