Detecting a heap spray attack
AssigneePalo Alto Networks, Inc.
InventorsChienHua Lu, Bo Qu, Kyle Sanders
Life of this patent
Estimating the term…
Abstract
Various techniques for exploit detection based on heap spray detection are disclosed. In some embodiments, exploit detection based on heap spray detection includes executing a program in a virtual environment, monitoring a heap of a memory while executing the program in the virtual environment, and detecting a potential heap spray attack based on detecting a burst allocation of a first plurality of blocks in the heap of the memory, in which each of the first plurality of blocks is stored in the predefined address range of the memory.
Claims23
(canceled)
A system for exploit detection by detecting heap spray in memory, comprising:
- a processor configured to:
- execute a program in a virtual environment;
- monitor a heap of the memory while executing the program in the virtual environment;
- and
- perform a first stage of analysis while monitoring the heap of the memory while executing the program in the virtual environment, the first stage of analysis comprising:
- detect a potential heap spray attack based on detecting a burst allocation of a first plurality of blocks in the heap of the memory;
- and
- determine whether each of the first plurality of blocks is stored in a predefined address range of the memory;
- in the event that during the first stage of analysis (1) the burst allocation of the first plurality of blocks is detected, and (2) each of the first plurality of blocks is stored in the predefined address range of the memory, then perform a second stage of analysis, the second stage of analysis comprising:
- perform a comparison of each of a second plurality of blocks allocated in the heap of the memory, wherein each of the second plurality of blocks is stored in the predefined address range of the memory;
- and
- detect a heap spray in memory based on the comparison of each of the second plurality of blocks allocated in the heap of the memory;
- and
- a computer data storage coupled to the processor and configured to provide the processor with instructions.
A method for exploit detection by detecting heap spray in memory, comprising:
- executing a program in a virtual environment;
- monitoring a heap of the memory while executing the program in the virtual environment;
- performing a first stage of analysis while monitoring the heap of the memory while executing the program in the virtual environment, the first stage of analysis comprising:
- detecting a potential heap spray attack based on detecting a burst allocation of a first plurality of blocks in the heap of the memory;
- and
- determining whether each of the first plurality of blocks is stored in a predefined address range of the memory;
- in the event that during the first stage of analysis (1) the burst allocation of the first plurality of blocks is detected, and (2) each of the first plurality of blocks is stored in the predefined address range of the memory, then performing a second stage of analysis, the second stage of analysis comprising:
- performing a comparison of each of a second plurality of blocks allocated in the heap of the memory, wherein each of the second plurality of blocks is stored in the predefined address range of the memory;
- and
- detecting a heap spray in memory based on the comparison of each of the second plurality of blocks allocated in the heap of the memory.
Dependencies are inferred from the claim text.