US 11,386,207 B2 · Metadata-based floating code signature generation for endpoint devices of a computer network

Abstract

A method comprises detecting a plurality of floating code instances associated with one or more endpoint devices of a computer network, obtaining metadata of each of the floating code instances, and generating floating code signatures for respective ones of the floating code instances based at least in part on their respective metadata. The floating code signatures are utilized to categorize one or more of the floating code instances as at least potentially malicious floating code instances. A given one of the floating code instances illustratively comprises an executable code block dynamically allocated in a memory of a corresponding one of the endpoint devices and does not include any file structure counterpart. The metadata utilized to generate the floating code signature of a given one of the floating code instances illustratively comprises at least one of image hook metadata and thread metadata of the given floating code instance.

Claims20

Dependent claims

A method comprising:

detecting a plurality of floating code instances associated with one or more endpoint devices of a computer network;
obtaining metadata of each of the floating code instances;
and
generating floating code signatures for respective ones of the floating code instances based at least in part on their respective metadata;
wherein the floating code signatures are utilized to categorize one or more of the floating code instances as having at least a specified maliciousness;
and
wherein the method is performed by at least one processing device comprising a processor coupled to a memory.

4 more elements

Dependencies are inferred from the claim text.

Metadata-based floating code signature generation for endpoint devices of a computer network

Life of this patent

Metadata-based floating code signature generation for endpoint devices of a computer network

Life of this patent

Abstract

Claims20