Shellcode detection
AssigneeCylance Inc.
InventorsMahdi Azarafrooz, Derek A. Soeder
Life of this patent
Estimating the term…
Abstract
Identifying shellcode in a sequence of instructions by identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions, identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions, and generating a distribution for the sequence of instructions, bounded by the first instruction and the second instructions, the distribution indicative of whether the sequence of instructions is likely to include shellcode.
Claims20
A system comprising:
- at least one processor;
- and
- at least one memory including program code which when executed by the at least one processor causes operations comprising:
- identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions;
- identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions;
- generating a distribution for the sequence of instructions, bounded between the first bound and the second bound, the distribution indicative of whether the sequence of instructions is likely to include shellcode;
- determining, based on the distribution and by a machine-learning model, a likelihood of whether the sequence of instructions is likely to include shellcode;
- and
- preventing the sequence of instructions from being executed if it determined that the sequence of instructions is likely to include shellcode;
- wherein the machine-learning model is assumptionless as to a form of and as to a frequency distribution of one or more mnemonics within the sequence of instructions, based on observed distributions of the one or more mnemonics in a first section of the sequence of instructions.
A computer-implemented method comprising:
- identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions;
- identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions;
- and
- generating a distribution for the sequence of instructions, bounded between the first bound and the second bound, the distribution indicative of whether the sequence of instructions is likely to include shellcode;
- determining, based on the distribution and by a machine-learning model, a likelihood of whether the sequence of instructions is likely to include shellcode;
- and
- preventing the sequence of instructions from being executed if it determined that the sequence of instructions is likely to include shellcode;
- wherein the machine-learning model is assumptionless as to a form of and as to a frequency distribution of one or more mnemonics within the sequence of instructions, based on observed distributions of the one or more mnemonics in a first section of the sequence of instructions.
A non-transient computer readable medium containing program instructions which, when executed by at least one processor, cause the at least one processor to perform one or more operations, the operations comprising:
- identifying a first instruction, the first instruction identifying a first bound of a sequence of instructions;
- identifying a second instruction, the second instruction identifying a second bound of the sequence of instructions;
- generating a distribution for the sequence of instructions, bounded between the first bound and the second bound, the distribution indicative of whether the sequence of instructions is likely to include shellcode;
- and
- determining, based on the distribution and by a machine-learning model, a likelihood of whether the sequence of instructions is likely to include shellcode;
- and
- preventing the sequence of instructions from being executed if it determined that the sequence of instructions is likely to include shellcode;
- wherein the machine-learning model is assumptionless as to a form of and as to a frequency distribution of one or more mnemonics within the sequence of instructions, based on observed distributions of the one or more mnemonics in a first section of the sequence of instructions.
Dependencies are inferred from the claim text.