Security monitor

A method of monitoring the execution of an application and one or more software component associated therewith in accordance with a predetermined security policy, said method comprising the steps of:

• intercepting a selected set of application programming interface (API) function calls issued by said monitored application by replacing the addresses of all API functions to be intercepted in an import data table associated with said monitored application with addresses of security monitor functions, each security monitor function associated with a different API function;
• intercepting API function calls issued by said software component by replacing the addresses of API functions to be intercepted in an import data table associated with said software component with addresses of stub functions, each stub function operative to call a security monitor function associated with a different API function;
• intercepting non-API function calls issued by said software component by replacing the addresses of non-API functions to be intercepted in an import data table associated with said software component with addresses of stub functions, each stub function operative to call a security monitor function associated with a different non-API function;
• determining whether an intercepted API call issued by said monitored application originated from a non-API call issued by the software component via the generation of a call chain by said software component when a non-API function is called;
• blocking intercepted API calls that originated with a non-API call from the software component that are forbidden according to the security policy;
• and
• allowing intercepted API calls that originated with a non-API call from the software component that are permitted according to the security policy.

A method of monitoring the execution of application and one or more software components associated therewith in accordance with a predetermined security policy, said method comprising the steps of:

• injecting a security monitor into the address space of said monitored application;
• generating a plurality of stub functions corresponding to application programming interface (API) function calls and non-API function calls which are called by the software component;
• redirecting all API calls and all non-API calls made by the software component;
• redirecting API calls made by said monitored application to said security monitor;
• setting a flag when said software component makes a call to either an API function or a non-API function;
• redirecting a portion of API calls received by said plurality of stub functions to said security monitor;
• redirecting said non-API calls made by the software component to their corresponding non-API functions;
• and
• applying the predetermined security policy to an API call when said flag is set.

A method of monitoring the execution of an application and one or more software components associated therewith in accordance with a predetermined security policy, said method comprising the steps of:

• applying interception to the application including all its modules whether loaded initially or during execution thereof;
• detecting the loading of a software component external to the application;
• applying interception to all calls made by the software component to functions located in other modules;
• and
• applying the security policy to said calls made by the software component.

A method of monitoring the execution of an application and one or more software components associated therewith in accordance with a predetermined security policy, said method comprising the steps of:

• installing means for interception within said monitored application including all modules associated therewith whether loaded initially or during execution thereof;
• detecting the loading of a sore component external to said monitored application;
• installing means for intercepting to all API and non-API function calls made by the software component to functions located in other modules;
• setting a flag when a function call is issued by the software component to any function located in another module located external thereto;
• and
• applying the security policy to an API call when said flag is set.

A method of creating a secure sandbox around both a monitored application and one or more software components associated therewith in accordance with a predetermined security policy, said method comprising the steps of:

• intercepting a selected set of application programming interface (API) function calls issued by said monitored application by replacing the addresses of all API functions to be intercepted in an import data table associated with said monitored application with addresses of security monitor functions, each security monitor function associated with a different API function;
• detecting a load API function call issued by said monitored application;
• blocking intercepted API calls that are forbidden according to the security policy;
• and
• allowing intercepted API calls that are permitted according to the security policy.