Malware detection in memory
AssigneeIntel Corporation
InventorsDanyu Bi, Salmin Sultana, Yuanyuan Li, Yong Jiang, Pramod Pesara, Selvakumar Panneer, Ravi Sahita
Life of this patent
Estimating the term…
Abstract
A system for detecting malware includes a processor to collect processor trace information corresponding to an application being executed by the processor (202). The processor can also detect an invalid indirect branch instruction from the processor trace information (204) and detect at least one malware instruction being executed by the application in response to analyzing modified memory values corresponding to the invalid indirect branch (206). Additionally, the processor can block the application from accessing or modifying memory (208).
Claims21
A system for detecting malware comprising:
- a processor to:
- collect processor trace information corresponding to instructions for an application being executed by the processor, the instructions to include an indirect branch instruction, the processor trace information to indicate a memory address of the indirect branch instruction;
- determine whether the memory address of the indirect branch instruction is listed in a set of allowed target addresses for the indirect branch instruction;
- detect a control flow integrity (CFI) violation of a CFI policy associated with the application being executed by the processor when the memory address of the indirect branch instruction is not listed in the set of allowed target addresses for the indirect branch instruction;
- initiate a scan of executed memory pages associated with the application being executed by the processor in response to detection of the CFI violation, the memory pages organized into different priority queues to prioritize an order for the memory page scans;
- detect at least one malware instruction being executed by the application in response to scanning the memory pages organized into the different priority queues;
- and
- block the application from accessing or modifying memory.
A method for detecting malware comprising:
- collecting processor trace information corresponding to instructions for an application being executed by a processor, the instructions to include an indirect branch instruction, the processor trace information to indicate a memory address of the indirect branch instruction;
- determining whether the memory address of the indirect branch instruction is listed in a set of allowed target addresses for the indirect branch instruction;
- detecting a control flow integrity (CFI) violation of a CFI policy associated with the application being executed by the processor when the memory address of the indirect branch instruction is not listed in the set of allowed target addresses for the indirect branch instruction;
- initiating scanning of executed memory pages associated with the application being executed by the processor in response to detection of the CFI violation, the memory pages organized into different priority queues to prioritize an order for the memory page scans;
- detecting at least one malware instruction being executed by the application in response to scanning the memory pages organized into the different priority queues;
- and
- blocking the application from accessing or modifying memory.
A non-transitory computer readable media for detecting malware comprising a plurality of instructions that, in response to execution by a processor, cause the processor to:
- collect processor trace information corresponding to instructions for an application being executed by the processor, the instructions to include an indirect branch instruction, the processor trace information to indicate a memory address of the indirect branch instruction;
- determine whether the memory address of the indirect branch instruction is listed in a set of allowed target addresses for the indirect branch instruction;
- detect a control flow integrity (CFI) violation of a CFI policy associated with the application being executed by the processor when the memory address of the indirect branch instruction is not listed in the set of allowed target addresses for the indirect branch instruction;
- initiate a scan of executed memory pages associated with the application being executed by the processor in response to detection of the CFI violation, the memory pages organized into different priority queues to prioritize an order for the memory page scans;
- detect at least one malware instruction being executed by the application in response to scanning the memory pages organized into the different priority queues;
- and
- block the application from accessing or modifying memory.
Dependencies are inferred from the claim text.