US 11,080,397 B2 · Using trap cache segments to detect malicious processes

Abstract

Provided are a computer program product, system, and method for using trap cache segments to detect malicious processes. A trap cache segment to the cache for data in the storage and indicated as a trap cache segment. Cache segments are added to the cache having data from the storage that are not indicated as trap cache segments. A memory function call from a process executing in the computer system reads data from a region of a memory device to output the read data to a buffer of the memory device. A determination is made as to whether the region of the memory device includes the trap cache segment. The memory function call is blocked and the process is treated as a potentially malicious process in response to determining that the region includes the trap cache segment.

Claims25

Dependent claims

A computer program product for detecting potentially malicious code accessing data in a computer system having a cache to store data from a storage, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:

adding a trap cache segment to the cache for a location in the storage, the cache implemented in at least one memory device, the storage implemented in at least one storage device separate from the at least one memory device;
indicating the trap cache segment as a trap cache segment;
adding cache segments to the cache having data from locations in the storage that are not indicated as trap cache segments;
processing a memory function call from a process executing in the computer system to read a target cache segment from the cache;
determining whether the target cache segment includes the trap cache segment;
and
blocking the memory function call and treat the process as a potentially malicious process in response to determining that the target cache segment includes the trap cache segment.

4 more elements

A system for detecting potentially malicious code accessing data stored in a storage, comprising:

a processor;
a cache implemented in a memory device;
and
a computer readable storage medium having computer readable program code embodied therein that when executed performs operations, the operations comprising:
adding a trap cache segment to the cache for a location in the storage, the cache implemented in at least one memory device, the storage implemented in at least one storage device separate from the at least one memory device;
indicating the trap cache segment as a trap cache segment;
adding cache segments to the cache having data from locations in the storage that are not indicated as trap cache segments;
processing a memory function call from a process executing in the system to read a target cache segment from the cache;
determining whether the target cache segment includes the trap cache segment;
and
blocking the memory function call and treat the process as a potentially malicious process in response to determining that the target cache segment includes the trap cache segment.

8 more elements

Dependencies are inferred from the claim text.

Using trap cache segments to detect malicious processes

Life of this patent

Using trap cache segments to detect malicious processes

Life of this patent

Abstract

Claims25