Systems and Methods of Asynchronous Analysis of Event Notifications for Computer Security Applications
AssigneeBitdefender IPR Management Ltd.
InventorSandor LUKACS
Life of this patent
Estimating the term…
Abstract
Described systems and methods enable an efficient detection and analysis of software events, especially in hardware virtualization configurations. In some embodiments, certain types of events are analyzed asynchronously, in the sense that the triggering entity is allowed to continue execution while the respective event is added to a queue for later processing. Some embodiments modify the instruction set architecture of the processor by adding a processor instruction dedicated to delivering event notifications. Such notification instructions allow for complex and flexible event detection without some of the disadvantages of conventional methods such as hooking.
Claims21
A host system comprising a hardware processor and a memory, the hardware processor configured to execute a notification handler and a computer security program, the hardware processor further configured to:
- receive from the memory an event notification instruction forming part of a currently executing process, wherein execution of the process causes an occurrence of a trigger event, wherein the event notification instruction comprises an operator field and an operand field, wherein the operand field comprises an identifier of an event type of the trigger event;
- in response to receiving the event notification instruction, suspend execution of the process;
- and
- in response to suspending execution of the process, switch to executing the notification handler,
- wherein the notification handler is configured to:
- determine whether an event eligibility condition is satisfied according to the event type of the trigger event,
- in response, when the event eligibility condition is satisfied, insert an event indicator into an event queue, the event indicator indicative of the trigger event, and
- in response to inserting the event indicator into the event queue, instruct the hardware processor to resume execution of the process, and
- wherein the computer security program is configured to:
- in response to the hardware processor resuming execution of the process, remove the event indicator from the queue, and
- determine according to the event indicator whether the occurrence of the trigger event is indicative of a computer security threat.
A non-transitory computer-readable medium storing processor instructions which, when executed by a hardware processor of a host system, cause the host system to form a notification handler and a computer security program, wherein the hardware processor is configured to:
- receive from a memory of the host system an event notification instruction forming part of a currently executing process, wherein execution of the process causes an occurrence of a trigger event, wherein the event notification instruction comprises an operator field and an operand field, wherein the operand field comprises an identifier of an event type of the trigger event;
- in response to receiving the event notification instruction, suspend execution of the process;
- and
- in response to suspending execution of the process, switch to executing the notification handler,
- wherein the notification handler is configured to:
- determine whether an event eligibility condition is satisfied according to the event type of the trigger event,
- in response, when the event eligibility condition is satisfied, insert an event indicator into an event queue, the event indicator indicative of the trigger event, and
- in response to inserting the event indicator into the event queue, instruct the hardware processor to resume execution of the process, and
- wherein the computer security program is configured to:
- in response to the hardware processor resuming execution of the process, remove the event indicator from the queue, and
- determine according to the event indicator whether the occurrence of the trigger event is indicative of a computer security threat.
A method of protecting a host system against computer security threats, the host system comprising a hardware processor and a memory, the method comprising:
- employing the hardware processor to receive from the memory an event notification instruction forming part of a process, wherein executing the process would cause an occurrence of a trigger event, the event notification instruction comprising an operator field and an operand field, wherein the operand field comprises an identifier of an event type of the trigger event;
- in response to receiving the event notification instruction, employing the hardware processor to suspend execution of the process;
- in response to suspending execution of the process, employing the hardware processor to determine whether an event eligibility condition is satisfied according to the event type of the trigger event;
- in response, when the event eligibility condition is satisfied, employing the hardware processor to insert an event indicator into an event queue, the event indicator indicative of the trigger event;
- in response to inserting the event indicator into the event queue, employing the hardware processor to resume execution of the process;
- in response to resuming execution of the process, employing the hardware processor to remove the event indicator from the queue;
- and
- employing the hardware processor to determine according to the event indicator whether the occurrence of the trigger event is indicative of a computer security threat.
Dependencies are inferred from the claim text.