System and method for enabling a malware prevention module in response to a context switch within a certain process being executed by a processor

A method of identifying a context switch and detecting malware, comprising:

• generating a list of permissible branch addresses;
• detecting a context switch intended to switch execution from a first process to a second process, the detecting of the context switch being by detecting flushing of an instruction translation lookaside buffer;
• incrementing, in response to the flushing, a counter;
• configuring a performance monitoring unit within a processor to generate a performance monitoring interrupt (PMI) in response to the counter achieving a predetermined value;
• enabling, in response to the performance monitoring interrupt, a malware detection module;
• while the second process is executing, receiving a report from the processor that a branch prediction unit in the processor identified a branch misprediction wherein an address was not predicted by the branch prediction unit;
• and
• generating, by the malware detection module, an alert or taking a protective action if the address is not contained within the list of permissible branch addresses.

A system for malware detection, the system comprising:

• a processor configured to execute instructions stored in memory to perform a method, the method comprising:
• generating a list of permissible branch addresses;
• detecting a context switch from a first process to a second process by detecting flushing of an instruction translation lookaside buffer;
• in response to the detecting of the context switch, configuring a performance monitoring unit within the processor to generate a performance monitoring interrupt (PMI);
• in response to the performance monitoring interrupt, enabling a malware detection module;
• while the second process is executing, receiving a report from the processor that a branch prediction unit in the processor identified a branch misprediction indicating an address was not predicted by the branch prediction unit;
• determining that the address, that was not predicted by the branch prediction unit, is not contained within the list of permissible branch addresses;
• and
• in response to the determining that the address is not contained within the list of permissible branch addresses, generating, by the malware detection module, an alert or taking a protective action.

A method of operating a malware detection system in a computing device, the computing device comprising a processor comprising one or more processing cores, a performance monitoring unit, a translation lookaside buffer, and a branch prediction unit, the performance monitoring unit comprising a first counter and a second counter, the method comprising:

• configuring the first counter to increment when the translation lookaside buffer is flushed;
• enabling the first counter;
• configuring the second counter to increment when the one or more processing cores cause a mode switch to occur;
• receiving a first performance monitoring interrupt generated by the performance monitoring unit when the first counter reaches a predetermined value;
• in response to the first performance monitoring interrupt, disabling the first counter, resetting and enabling the second counter, and executing a first operator-configured function;
• receiving a second performance monitoring interrupt generated by the performance monitoring unit when the second counter reaches a predetermined value;
• and
• in response to the second performance monitoring interrupt, disabling the second counter and resetting and enabling the first counter.

A system for malware detection, the system comprising:

• a processor comprising one or more processing cores, a performance monitoring unit, a translation lookaside buffer, and a branch prediction unit, the performance monitoring unit comprising a first counter and a second counter;
• a first module, executed by the processor, for configuring the first counter to increment when the translation lookaside buffer is flushed, the first module further for configuring a second counter to increment when a branch misprediction occurs;
• the first module for configuring the performance monitoring unit to generate a first performance monitoring interrupt when the first counter is enabled and reaches a predetermined value, and to generate a second performance monitoring interrupt when the second counter is enabled and reaches a predetermined value;
• and
• wherein the processor is configured to, upon receipt of the first performance monitoring interrupt, disable the first counter, reset and enable the second counter, and execute a first operator-configured function.