US 10,382,482 B2Granted

Polymorphic obfuscation of executable code

AssigneeShape Security, Inc.

InventorsSiying Yang, Jarrod Overson, Ben Vinegar, Bei Zhang

Life of this patent

Estimating the term…

Loading patent…

Abstract

This document generally relates to systems, method, and other techniques for identifying and interfering with the operation of computer malware, as a mechanism for improving system security. Some implementations include a computer-implemented method by which a computer security server system performs actions including receiving a request for content directed to a particular content server system; forwarding the request to the particular content server system; receiving executable code from the particular content server system; inserting executable injection code into at least one file of the executable code; applying a security countermeasure to the combined executable code and executable injection code to create transformed code; and providing the transformed code to a client computing device.

Claims23

Dependent claims

A computer-implemented method, comprising:

receiving, at a computer security server system located between the Internet and a client computing device that makes requests over the Internet, a request, for content comprising main code executable at the client computing device, that is directed to a particular content server system;
forwarding, by the computer security server system, the request to the particular content server system;
obtaining executable injection code that, when inserted in the main code, does not alter, from a user's perspective, execution of the main code at the client computing device;
in response to the request, receiving, from the particular content server system, the main code;
identifying a plurality of locations in the main code where the executable injection code can be inserted into the main code such that the executable injection code is needed to perform the functionality of the main code without altering the execution of the main code from the user's perspective;
selecting a first set of one or more locations from the plurality of locations;
inserting into the main code, at the first set of one or more locations, the executable injection code such that the executed injection code is needed to perform the functionality of the main code without altering the execution of the main code from the user's perspective;
and
after inserting the executable injection code, providing the main code to the client computing device.

6 more elements

A computer system comprising:

one or more hardware processors;
at least one memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to:
receive, from a client computing device that makes requests over the Internet, a request, for content comprising main code executable at the client computing device, that is directed to a particular content server system;
forward the request to the particular content server system;
obtain executable injection code that, when inserted in the main code, does not alter, from a user's perspective, execution of the main code at the client computing device;
in response to the request, receive, from the particular content server system, the main code;
identify a plurality of locations in the main code where the executable injection code can be inserted into the main code such that the executable injection code is needed to perform the functionality of the main code without altering the execution of the main code from the user's perspective;
select a first set of one or more locations from the plurality of locations;
insert into the main code, at the first set of one or more locations, the executable injection code such that the executed injection code is needed to perform the functionality of the main code without altering the execution of the main code from the user's perspective;
and
after inserting the executable injection code, provide the main code to the client computing device.

8 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/756,557Filed 30 Aug 2016 · continuation
Priority: 31 Aug 2015
Published: US 2018/0248913 A130 Aug 2018
Granted: 13 Aug 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1483
Countermeasures against malicious traffic: service impersonation, e.g. phishing, pharming or web spoofing
G06F 21/54
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by adding security routines or objects to programs
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
H04L 63/1466
Countermeasures against malicious traffic: active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g.…

Family

Application14/841,013Parent of this continuation · filed 31 Aug 2015
US 9,807,113 B2Parent of this continuation · filed 31 Oct 2017
US 2018/0248913 A1Pre-grant publication · published 30 Aug 2018
US 2017/0063923 A1Published application
US 10,382,482 B2This patent

From the US filing history. Foreign family members aren’t listed.