Sub-execution environment controller
AssigneeCylance Inc.
InventorsRyan Permeh, Derek Soeder, Matthew Wolff, Ming Jin, Xuan Zhao
Life of this patent
Estimating the term…
Abstract
In one aspect there is provided a method. The method may include: determining that an executable implements a sub-execution environment, the sub-execution environment being configured to receive an input, and the input triggering at least one event at the sub-execution environment; intercepting the event at the sub-execution environment; and applying a security policy to the intercepted event, the applying of the policy comprises blocking the event, when the event is determined to be a prohibited event. Systems and articles of manufacture, including computer program products, are also provided.
Claims42
A computer-implemented method, comprising:
- determining that an executable implements a sub-execution environment, the sub-execution environment being configured to receive an input, and the input being associated with at least one event at the sub-execution environment;
- intercepting the event at the sub-execution environment;
- and
- applying a security policy to the intercepted event, the applying of the policy comprising blocking the event, when the event is determined to be a prohibited event.
A system, comprising:
- at least one data processor;
- and
- at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
- determining that an executable implements a sub-execution environment, the sub-execution environment being configured to receive an input, and the input being associated with at least one event at the sub-execution environment;
- intercepting the event at the sub-execution environment;
- and
- applying a security policy to the intercepted event, the applying of the policy comprising blocking the event, when the event is determined to be a prohibited event.
A non-transitory computer-readable storage medium including program code, which when executed by at least one data processor, cause operations comprising:
- determining that an executable implements a sub-execution environment, the sub-execution environment being configured to receive an input, and the input being associated with at least one event at the sub-execution environment;
- intercepting the event at the sub-execution environment;
- and
- applying a security policy to the intercepted event, the applying of the policy comprising blocking the event, when the event is determined to be a prohibited event.
An apparatus, comprising:
- means for determining that an executable implements a sub-execution environment, the sub-execution environment being configured to receive an input, and the input being associated with at least one event at the sub-execution environment;
- means for intercepting the event at the sub-execution environment;
- and
- means for applying a security policy to the intercepted event, the applying of the policy comprising blocking the event, when the event is determined to be a prohibited event.
Dependencies are inferred from the claim text.