System and method for detecting and for alerting of exploits in computerized systems
AssigneePerception Point Ltd.
InventorsShlomi Levin, Michael Aminov
Life of this patent
Estimating the term…
Abstract
Systems and methods of detecting an exploit of a vulnerability of a computing device, including receiving an execution flow of at least one process running in a processor of the computing device, wherein the execution flow is received from a performance monitoring unit (PMU) of the processor, receiving memory pages from a memory of the computing device, reconstructing the execution flow of the process on another processor based on PMU data and the memory pages, running at least one exploit detection algorithm on the reconstructed process in order to identify an exploit attempt and issuing an alert.
Claims19
A method of detecting an exploit of a vulnerability of a computing device, the method comprising:
- receiving an execution flow of at least one process running in a first physical processor of the computing device, wherein the execution flow is received from a performance monitoring unit (PMU) of the first physical processor;
- receiving memory pages from a memory of the computing device;
- continuously checking, by another physical processor which is physically separate from the first processor, the execution flow of the first processor, to identify a memory value that is mapped to stack memory by the another physical processor;
- reconstructing the execution flow of the process on the another physical processor based on the execution flow received from the PMU and the memory pages;
- running at least one exploit detection algorithm on the reconstructed execution flow of the process in order to identify an exploit attempt;
- and
- issuing an alert.
Dependencies are inferred from the claim text.