Automated runtime detection of malware
AssigneeVirsec Systems, Inc.
InventorsSatya V. Gupta, Raymond F. DeMeo
Life of this patent
Estimating the term…
Abstract
One example method and correspond apparatus extracts a model of a computer application during load time and stores the model of the computer application in a database. This example method and corresponding apparatus also inserts instructions into the computer application to collect data at runtime. This example method and corresponding apparatus then analyzes the data collected at runtime against the stored model of the computer application to detect one or more security events and tracks the one or more security events using a state machine.
Claims18
A computer-implemented method comprising:
- prior to executing a module of a computer application and before the module is loaded into memory, verifying integrity of the module as the module of the computer application is being loaded into the memory by adding instructions into an execution pipeline, wherein the instructions are added into the execution pipeline as the module is being loaded into the memory and the instructions are configured for:
- computing a checksum of the module;
- comparing the computed checksum against a valid checksum stored in memory for the module;
- and
- generating at least one security event if the computed checksum does not match the valid checksum, the at least one security event triggering at least one remedial action related to the computer application.
A computer system comprising:
- prior to executing a module of a computer application and before the module is loaded into memory, verifying integrity of the module as the module of the computer application is being loaded into the memory by:
- a client configured to add instructions into an execution pipeline, wherein the instructions are added into the execution pipeline as the module is being loaded into the memory and the instructions are configured to:
- compute a checksum of the module;
- and
- compare the computed checksum against a valid checksum stored in memory for the module;
- and
- an analysis engine configured to:
- generate at least one security event if the computed checksum does not match the valid checksum, the at least one security event triggering at least one remedial action related to the computer application.
Dependencies are inferred from the claim text.