Back to results
US 2018/0018460 A1Published application
Inferential exploit attempt detection
AssigneeCrowdStrike, Inc.
InventorsDaniel W. Brown, Ion-Alexandru Ionescu, Loren C. Robinson
Life of this patent
Estimating the term…
Abstract
A security agent implemented on a monitored computing device is described herein. The security agent is configured to detect an action of interest (AoI) that may be probative of a security exploit and to determine a context in which that AoI occurred. Based on that context, the security agent is further configured to decide whether the AoI is a security exploit and can take preventative action to prevent the exploit from being completed.
Claims20
A method comprising:
- receiving, by a call stack actor (CSA), a request to examine a context of an action of interest (AoI);
- generating, by the CSA and based at least in part on the request, a characterization of a call stack associated with the AoI, the generating based at least in part on walking through the call stack;
- and
- determining, by a security agent and based at least in part on the characterization, that the AoI includes a security exploit.
1 more element
A computing device including:
- a processor;
- a call stack actor (CSA) configured to be executed by the processor on the computing device, the CSA including:
- logic configured to receive a request to perform analysis of an action of interest (AoI) and provide a characterization to a security agent;
- and
- a call stack walker configured to:
- identify addresses of memory devoted to a call stack associated with the AoI, and
- generate the characterization from the call stack associated with the AoI based at least in part on walking the call stack starting at an entry associated with the AoI;
- and
- the security agent configured to be executed by the processor on the computing device, the security agent including logic configured to receive the characterization and determine that the AoI is a security exploit of the computing device based at least in part on the characterization.
6 more elements
A system including:
- a processor;
- a memory having stored thereon computer-executable instructions that, when executed by the one or more processors, configure the system to perform operations including:
- detecting an action of interest (AoI) from among actions taken by the system;
- identifying a record stored in the memory and recording previous actions taken by the system that resulted in the AoI;
- examining a record for evidence that the AoI is an exploit of the system, the record being stored on the memory;
- and
- taking preventative measures regarding the AoI when the record contains evidence that the AoI is an exploit.
4 more elements
Dependencies are inferred from the claim text.