Memory Hybrid-Dynamic Vulnerability Assessment
AssigneeVirsec Systems, Inc.
InventorDanny Kim
Life of this patent
Estimating the term…
Abstract
Embodiments identify legitimate application code paths and protect applications from malicious attacks. Responsive to loading code of an executing application into memory, one or more call instructions in the code are identified. In turn, a list of one or more legitimate return instruction destinations is created based on the identified one or more call instructions. In this way, legitimate code paths of the application are identified. This identified list of legitimate return instruction destinations is used to control the execution of the application so as to protect against malicious attacks. An embodiment, upon encountering a given return instruction, determines if a given destination of the given return instruction is approved or unapproved.
Claims20
A computer-implemented method comprising:
- responsive to loading code of an executing application into memory, identifying one or more call instructions in the code;
- and
- based on the identified one or more call instructions, creating a list of one or more legitimate return instruction destinations, thereby identifying legitimate code paths of the application.
A system comprising:
- a processor;
- and
- a memory with computer code instructions stored thereon, the processor and the memory, with the computer code instructions, being configured to cause the system to:
- responsive to loading code of an executing application into memory, identify one or more call instructions in the code;
- and
- based on the identified one or more call instructions, create a list of one or more legitimate return instruction destinations, thereby identifying legitimate code paths of the application.
A computer program product comprising:
- one or more non-transitory computer readable storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions, when loaded and executed by a processor, cause an apparatus associated with the processor to:
- responsive to loading code of an executing application into memory, identify one or more call instructions in the code;
- and
- based on the identified one or more call instructions, create a list of one or more legitimate return instruction destinations, thereby identifying legitimate code paths of the application.
Dependencies are inferred from the claim text.