Detecting malicious software by inspecting table look-aside buffers
AssigneePaypal, Inc.
InventorShlomi Boutnaru
Life of this patent
Estimating the term…
Abstract
Systems and methods that detect presence of malicious software while comparing address mappings in multiple table look-aside buffers are provided. Address mappings in an instruction table look-aside buffer (ITLB) and a data table look-aside buffer (DTLB) may be scanned with each address mapping including a mapping between a virtual page in a virtual memory and a frame in a physical memory of a computing device. A discrepancy between an address mapping in the ITLB and an address mapping in the DTLB can be identified. Based on the discrepancy, a process associated with the mapping may then be identified as a malicious process.
Claims20
A system, comprising:
- a non-transitory memory storing instructions;
- and
- one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the system to perform operations comprising:
- scanning a plurality of address mappings between a virtual memory and a physical memory in an instruction table look-aside buffer (ITLB);
- scanning a plurality of address mappings between the virtual memory and the physical memory in a data table look-aside buffer (DTLB);
- determining a discrepancy between an address mapping from the address mappings in the ITLB and an address mapping from the address mappings in the DTLB;
- and
- determining whether a process is a malicious process based on the discrepancy.
A method, comprising:
- scanning address mappings in an instruction table look-aside buffer (ITLB), wherein each address mapping in the address mappings includes a virtual address mapped to a physical address;
- scanning address mappings in a data table look-aside buffer (DTLB), wherein each address mapping in the address mappings includes a virtual address mapped to a physical address;
- determining a discrepancy between an address mapping in the ITLB and an address mapping in the DTLB;
- and
- determining whether a process is a malicious process based on the discrepancy.
A non-transitory machine readable medium having stored thereon machine readable instructions executable to cause a machine to perform operations comprising:
- determining a discrepancy between an address mapping from a plurality of address mappings in an instruction table look-aside buffer (ITLB) and an address mapping from a plurality of address mappings in a data look-aside buffer (DTLB), wherein the address mapping in the ITLB maps a first virtual address of a first virtual page in a virtual memory to a first physical address of a first frame in a physical memory and wherein the address mapping in the DTLB maps a second virtual address of a second virtual page in the virtual memory to a second physical address of a second frame in the physical memory;
- determining whether a process as a malicious process based on the discrepancy;
- and
- preventing the malicious process from executing on the machine.
Dependencies are inferred from the claim text.