Loading patent…
AssigneeIntel Corporation
InventorsZheng Zhang, Jason Martin, Justin Gottschlich, Abhilasha Bhargav-Spantzel, Salmin Sultana, Li Chen, Wei Li, Priyam Biswas, Paul Carlson
Estimating the term…
Methods, systems, articles of manufacture and apparatus to detect process hijacking are disclosed herein. An example apparatus to detect control flow anomalies includes a parsing engine to compare a target instruction pointer (TIP) address to a dynamic link library (DLL) module list, and in response to detecting a match of the TIP address to a DLL in the DLL module list, set a first portion of a normalized TIP address to a value equal to an identifier of the DLL. The example apparatus disclosed herein also includes a DLL entry point analyzer to set a second portion of the normalized TIP address based on a comparison between the TIP address and an entry point of the DLL, and a model compliance engine to generate a flow validity decision based on a comparison between (a) the first and second portion of the normalized TIP address and (b) a control flow integrity model.
An apparatus to detect control flow anomalies the apparatus comprising:
(canceled)
(canceled)
11-13. (canceled)
A non-transitory computer readable storage medium comprising computer readable instructions that, when executed, cause at least one processor to:
(canceled)
18-20. (canceled)
(canceled)
(canceled)
A system to detect control flow anomalies, the system comprising:
32-39. (canceled)
A computer implemented method to detect control flow anomalies, the method comprising:
45-52. (canceled)
Dependencies are inferred from the claim text.