Automated Runtime Detection Of Malware
AssigneeVirsec Systems, Inc.
InventorsSatya V. Gupta, Raymond F. DeMeo
Life of this patent
Estimating the term…
Abstract
One example method and correspond apparatus extracts a model of a computer application during load time and stores the model of the computer application in a database. This example method and corresponding apparatus also inserts instructions into the computer application to collect data at runtime. This example method and corresponding apparatus then analyzes the data collected at runtime against the stored model of the computer application to detect one or more security events and tracks the one or more security events using a state machine.
Claims20
A computer-implemented method comprising:
- prior to executing a module of a computer application, verifying integrity of the module by:
- computing a checksum of the module;
- comparing the computed checksum against a valid checksum stored in memory for the module;
- and
- generating at least one security event if the computed checksum does not match the valid checksum, the at least one security event triggering at least one remedial action related to the computer application.
A computer system comprising:
- prior to executing a module of a computer application, verifying integrity of the module by:
- a client configured to:
- compute a checksum of the module;
- and
- compare the computed checksum against a valid checksum stored in memory for the module;
- and
- an analysis engine configured to:
- generate at least one security event if the computed checksum does not match the valid checksum, the at least one security event triggering at least one remedial action related to the computer application.
Dependencies are inferred from the claim text.