# US 12,572,656 B2 · Control flow integrity monitoring based insights > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,572,656 B2 - Document ID: US12572656B2 - Status: Granted - Kind: B2 - Application number: 18/084,007 - Filed: 2022-12-19 - Published: 2024-01-25 - Granted: 2026-03-10 - Earliest claimed: 2022-07-22 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Vincent E. Parla; Thomas Szigeti - Web page: https://patentgrep.com/patent/US12572656B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 8/433: {Dependency analysis; Data or control flow analysis} - G06F 8/75: Structural analysis for program understanding - G06F 9/44589: {Program code verification, e.g. Java bytecode verification, proof-carrying code (high-level semantic checks G06F8/43; prevention of errors by analysis, debugging or testing of software G06F11/36)} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/302: {where the computing system component is a software system} - G06F 11/323: {Visualisation of programs or trace data} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)} - G06F 11/3616: {using software metrics} - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 21/54: by adding security routines or objects to programs - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - G06F 8/53: Decompilation; Disassembly - G06F 2201/865: Monitoring of software - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques and systems described herein relate to monitoring executions of computer instructions on computing devices based on learning and generating a control flow directed graph. The techniques and systems include receiving a report of a first anomaly based on real-time control flow graph diagram monitoring of an application at a first system and receiving a second report of a second anomaly from a second system. An exploit report may be generated by providing the first report and the second report to a machine learning model trained to output information related to an exploit based on input reports, and subsequently to provide the output information to a cloud-based reporting tool. ## Claims ### Claim 1 A method for monitoring a plurality of computing systems of enterprise networks, comprising: obtaining, at a first computer system, a first control flow graph diagram representing first valid transfers of a first application observed during an observation phase; detecting, using the first control flow graph diagram, a first deviation between the first valid transfers and first real-time transfers of the first application executed by the first computer system, the first deviation being indicative of a first invalid transfer being included in the first real-time transfers; receiving a first report of the first deviation detected by first real-time monitoring of the first computer system of a first enterprise network of a first enterprise user; obtaining, at a second computer system, a second control flow graph diagram representing second valid transfers of a second application; detecting, using the second control flow graph diagram, a second deviation between the second valid transfers and second real-time transfers of the second application executed by the second computer system, the second deviation being indicative of a second invalid transfer being included in the second real-time transfers; receiving a second report of the second deviation detected by first real-time monitoring of the second computer system of a second enterprise network of a second enterprise user, the first enterprise network being different from the second enterprise network; generating, based on the first report and the second report, application exploit report data including a shared characteristic or a pattern indicated by the first report and the second report; and providing, to a cloud-based exploit reporting tool available to the first computer system and the second computer system, the application exploit report data. ### Claim 2 (depends on 1) The method of claim 1, wherein the first report and the second report are anonymized to remove identifying information associated with the first computer system and the second computer system. ### Claim 3 (depends on 1) The method of claim 1, wherein: the first report comprises information describing the first deviation, the first application, the first computer system, and the first enterprise user; and the second report comprises information describing the second deviation, the second application, the second computer system, and the second enterprise user. ### Claim 4 (depends on 3) The method of claim 3, wherein the application exploit report data comprises information describing one or more characteristics shared between the first enterprise user and the second enterprise user including at least one of an application version or an industry sector. ### Claim 5 (depends on 1) The method of claim 1, wherein the first application is different from the second application, and wherein the first enterprise user is different from the second enterprise user. ### Claim 6 (depends on 1) The method of claim 1, wherein the application exploit report data identifies a portion of code within the first application related to the first deviation, the portion of code determined based at least in part on the first control flow graph diagram for the first application. ### Claim 7 (depends on 1) The method of claim 1, further comprising: determining, during the observation phase, that a number of the first valid transfers is equal to or greater than a threshold number of total transfers associated with the first application; exiting the observation phase based at least in part on the number of the first valid transfers being equal to or greater than the threshold number of the total transfers; and entering into a monitoring phase during which the first control flow graph diagram is used to detect the first deviation. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving input from a security team to exit the observation phase; generating the first control flow graph diagram based at least in part on observations of the first valid transfers during the observation phase; and entering into a monitoring phase during which the first control flow graph diagram is used to detect the first deviation. ### Claim 9 A system comprising: one or more processors; and one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: obtaining, at a first computer system, a first control flow graph diagram representing first valid transfers of a first application observed during an observation phase; detecting, using the first control flow graph diagram, a first deviation between the first valid transfers and first real-time transfers of the first application executed by the first computer system, the first deviation being indicative of a first invalid transfer being included in the first real-time transfers; receiving a first report of the first deviation detected based on first real-time monitoring using the first control flow graph diagram of the first application executing at the first computer system of a first user of a first enterprise network; obtaining, at a second computer system, a second control flow graph diagram representing second valid transfers of a second application; detecting, using the second control flow graph diagram, a second deviation between the second valid transfers and second real-time transfers of the second application executed by the second computer system, the second deviation being indicative of a second invalid transfer being included in the second real-time transfers; receiving a second report of the second deviation detected based on second real-time control flow graph diagram monitoring of the second application running at the second computer system of a second user of a second enterprise network that is different from the first enterprise network; generating, based on performing a peer comparison of the first report and the second report, application exploit report data comprising an indication of a pattern or a shared characteristic of the first deviation and the second deviation; and providing, to a cloud-based exploit reporting tool available to the first computer system, the second computer system, and one or more other computer systems of other enterprise networks, the application exploit report data. ### Claim 10 (depends on 9) The system of claim 9, wherein the first report and the second report are anonymized to remove identifying information associated with the first computer system and the second computer system. ### Claim 11 (depends on 9) The system of claim 9, wherein: the first report comprises information describing the first deviation, the first application, the first computer system, and the first user; and the second report comprises information describing the second deviation, the second application, the second computer system, and the second user. ### Claim 12 (depends on 11) The system of claim 11, wherein the application exploit report data further comprises information describing one or more additional characteristics shared between the first user and the second user including at least one of an application version or an industry sector. ### Claim 13 (depends on 9) The system of claim 9, wherein the first application is different from the second application. ### Claim 14 (depends on 9) The system of claim 9, wherein the application exploit report data identifies a portion of code within the first application related to the first deviation, the portion of code determined based at least in part on the first control flow graph diagram for the first application. ### Claim 15 (depends on 9) The system of claim 9, wherein the first report comprises geographic information related to the first deviation, the second report comprises second geographic information related to the second deviation, and the application exploit report data indicates the first deviation and the second deviation correspond to a particular deviation and comprises geographic scope and location tracking of the particular deviation. ### Claim 16 One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to: obtain at a first computer system, a first control flow graph diagram representing first valid transfers of a first application observed during an observation phase; detect, using the first control flow graph diagram, a first deviation between the first valid transfers and first real-time transfers of the first application executed by the first computer system, the first deviation being indicative of a first invalid transfer being included in the first real-time transfers; receive a first report of the first deviation detected based on first real-time monitoring using the first control flow graph diagram of the first application executing at the first computer system of a first client of a first enterprise network; obtain, at a second computer system, a second control flow graph diagram representing second valid transfers of a second application; detect, using the second control flow graph diagram, a second deviation between the second valid transfers and second real-time transfers of the second application executed by the second computer system, the second deviation being indicative of a second invalid transfer being included in the second real-time transfers; receive a second report of the second deviation detected based on second real-time control flow graph diagram monitoring of the second application running at the second computer system of a second client of a second enterprise network that is different from the first enterprise network; generate, based on the first report and the second report, application exploit report data comprising an indication of a pattern or a shared characteristic of the first deviation and the second deviation; and provide, to a cloud-based exploit reporting tool available to the first computer system and the second computer system, the application exploit report data. ### Claim 17 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the first report and the second report are anonymized to remove identifying information associated with the first computer system and the second computer system. ### Claim 18 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein: the first report comprises information describing the first deviation, the first application, the first computer system, and the first client; and the second report comprises information describing the second deviation, the second application, the second computer system, and the second client. ### Claim 19 (depends on 18) The one or more non-transitory computer-readable media of claim 18, wherein the application exploit report data comprises information describing one or more characteristics shared between the first client and the second client including at least one of an application version or an industry sector. ### Claim 20 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein the application exploit report data identifies a portion of code within the first application related to the first deviation, the portion of code determined based at least in part on the first control flow graph diagram for the first application.