Method and system for detecting a keylogger that encrypts data captured on a computer

A system for detecting a keylogger that encrypts data captured on a computer, the system comprising:

• a data acquisition module configured to acquire first and second samples of a portion of a memory of the computer, the portion of the memory being associated with a running process on the computer;
• a data injection module configured to input to the computer, at a time between acquisition of the first and second samples and in a manner mimicking keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns;
• and
• an analysis module configured to:
• compare the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample;
• and
• flag the running process as a potential keylogger when:
• the at least one data segment contains a second data pattern consisting of at least one occurrence of each of a second set of distinct sub-patterns,
• each sub-pattern in the second set of distinct sub-patterns occurs the same number of times in the second data pattern as a corresponding unique sub-pattern in the first set of distinct sub-patterns occurs in the first data pattern, and
• the sub-patterns in the second data pattern occur in the same order as the corresponding unique sub-patterns occur in the first data pattern.

A system for detecting a keylogger that encrypts data captured on a computer, the system comprising:

• means for acquiring first and second samples of a portion of a memory of the computer, the portion of the memory being associated with a running process on the computer;
• means for inputting to the computer, at a time between acquisition of the first and second samples and in a manner mimicking keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns;
• means for comparing the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample;
• and
• means for flagging the running process as a potential keylogger when:
• the at least one data segment contains a second data pattern consisting of at least one occurrence of each of a second set of distinct sub-patterns,
• each sub-pattern in the second set of distinct sub-patterns occurs the same number of times in the second data pattern as a corresponding unique sub-pattern in the first set of distinct sub-patterns occurs in the first data pattern, and
• the sub-patterns in the second data pattern occur in the same order as the corresponding unique sub-patterns occur in the first data pattern.

A computer-readable storage medium containing program instructions executable by a processor to detect a keylogger that encrypts data captured on a computer, the program instructions comprising:

• a first instruction segment configured to acquire first and second samples of a portion of a memory of the computer, the portion of the memory being associated with a running process on the computer;
• a second instruction segment configured to input to the computer, at a time between acquisition of the first and second samples and in a manner mimicking keyboard input, a first data pattern consisting of at least one occurrence of each of a first set of distinct sub-patterns;
• and
• a third instruction segment configured to:
• compare the first and second samples of the portion of the memory to identify at least one data segment in which the second sample has changed relative to the first sample;
• and
• flag the running process as a potential keylogger when:
• the at least one data segment contains a second data pattern consisting of at least one occurrence of each of a second set of distinct sub-patterns,
• each sub-pattern in the second set of distinct sub-patterns occurs the same number of times in the second data pattern as a corresponding unique sub-pattern in the first set of distinct sub-patterns occurs in the first data pattern, and
• the sub-patterns in the second data pattern occur in the same order as the corresponding unique sub-patterns occur in the first data pattern.