# US 12,001,554 B2 · Just in time memory analysis for malware detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,554 B2 - Document ID: US12001554B2 - Status: Granted - Kind: B2 - Application number: 17/505,327 - Filed: 2021-10-19 - Published: 2022-02-03 - Granted: 2024-06-04 - Earliest claimed: 2017-10-13 - Assignees: SonicWALL, Inc. - Applicants: SonicWALL Inc. - Inventors: Soumyadipta Das; Alex Dubrovsky; Igor Korsunsky - Web page: https://patentgrep.com/patent/US12001554B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2125: Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and apparatus consistent with the present disclosure may use instrumentation code that remains transparent to an application program that the instrumentation code has been injected into. In certain instances, data sets that include executable code may be received via packetized communications or be received via other means, such as, receiving a file from a data store. The present technique allows a processor executing instrumentation code to monitor actions performed by the program code included in a received data set. Malware may be detected by scanning suspect program code with a malware scanner, malware may be detected by identifying suspicious actions performed by a set of program code, or malware may be detected by a combination of such techniques. ## Claims ### Claim 1 A method for analyzing computer data, the method comprising: allowing instructions of a set of computer data to be executed by a processor; monitoring actions performed by the execution of the instructions of the set of computer data, the monitoring performed by the processor executing a set of instrumentation code instructions; pausing execution of the instructions of the computer data based on an identification that the monitored actions include writing data to a memory; identifying that the monitored actions correspond to an access pattern of the memory that includes allocating a portion of the memory and includes invocation of an operating system program function, wherein the data written to the memory is written to a newly allocated memory portion; comparing a signature generated from the data written to the allocated memory portion of the memory to a malware signature generated from previously identified malicious code; and performing a corrective action based on an identification that the generated signature matches the malware signature. ### Claim 2 (depends on 1) The method of claim 1, further comprising identifying that the monitored actions include de-obfuscating the data written to the allocated memory portion of the memory. ### Claim 3 (depends on 1) The method of claim 1, further comprising generating the signature by scanning the data written to the allocated memory portion of the memory with a deep packet inspection (DPI) scanner. ### Claim 4 (depends on 1) The method of claim 1, further comprising identifying that the monitored actions include unpacking of the data from the set of computer data before the data is written to the allocated memory portion of the memory. ### Claim 5 (depends on 1) The method of claim 1, further comprising identifying that the monitored actions include marking the data written to the allocated memory portion of the memory as executable. ### Claim 6 (depends on 1) The method of claim 1, further comprising: identifying that a first action of the monitored actions corresponds to a first memory access state; identifying that a second action of the monitored actions corresponds to a second memory access state; identifying that the execution of the instructions of set of computer data has performed a suspicious behavior, the identification based on the first action occurring before the second action and based on a rule that identifies that the signature should be generated when the first memory access state occurs before the second memory access state; and generating the signature according to the rule. ### Claim 7 A non-transitory computer-readable storage medium having embodied thereon a program executable by a processor for implementing a method for analyzing computer data, the method comprising: allowing instructions of a set of computer data to be executed by a processor; monitoring actions performed by the execution of the instructions of the set of computer data, the monitoring performed by the processor executing a set of instrumentation code instructions; pausing execution of the instructions of the computer data based on an identification that the monitored actions include writing data to a memory; identifying that the monitored actions correspond to an access pattern of the memory that includes allocating a portion of the memory and includes invocation of an operating system program function, wherein the data written to the memory is written to a newly allocated memory portion; comparing a signature generated from the data written to the allocated memory portion to a malware signature generated from previously identified malicious code; and performing a corrective action based on an identification that the generated signature matches the malware signature. ### Claim 8 (depends on 7) The non-transitory computer-readable storage medium of claim 7, the program further executable to identify that the monitored actions include de-obfuscating the data written to the allocated memory portion. ### Claim 9 (depends on 7) The non-transitory computer-readable storage medium of claim 7, the program further executable to generate the signature by scanning the data written to the allocated memory portion with a deep packet inspection (DPI) scanner. ### Claim 10 (depends on 7) The non-transitory computer-readable storage medium of claim 7, the program further executable to identify that the monitored actions include unpacking of the data from the set of computer data before the data is written to the allocated memory portion. ### Claim 11 (depends on 7) The non-transitory computer-readable storage medium of claim 7, the program further executable to identify that the monitored actions include marking the data written to the allocated memory portion as executable. ### Claim 12 (depends on 7) The non-transitory computer-readable storage medium of claim 7, the program further executable to: identify that a first action of the monitored actions corresponds to a first memory access state; identify that a second action of the monitored actions corresponds to a second memory access state; identify that the execution of the instructions of set of computer data has performed a suspicious behavior, the identification based on the first action occurring before the second action and based on a rule that identifies that the signature should be generated when the first memory access state occurs before the second memory access state; and generate the signature according to the rule. ### Claim 13 An apparatus for analyzing computer data, the apparatus comprising: a memory; and a processor that executes instructions out of the memory to: execute instructions of a set of computer data; monitor actions performed by the execution of the instructions of the set of computer data, the monitoring performed by the processor executing a set of instrumentation code instructions, pause execution of the instructions of the computer data based on an identification that the monitored actions include writing data to the memory, identify that the monitored actions correspond to an access pattern of the memory that includes allocating a portion of the memory and includes invocation of an operating system program function, wherein the data written to the memory is written to a newly allocated memory portion, compare a signature generated from the data written to the allocated memory portion to a malware signature generated from previously identified malicious code, and perform a corrective action based on an identification that the generated signature matches the malware signature. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the execution of the set of instrumentation code instructions allow the processor to identify that the monitored actions include de-obfuscating the data written to the allocated memory portion. ### Claim 15 (depends on 13) The apparatus of claim 13, further comprising instructions of a set of deep packet inspection (DPI) program code, wherein execution of the instructions of the set of DPI program code generate the signature.