US 6,785,818 B1 · Thwarting malicious registry mapping modifications and map-loaded module masquerade attacks

Abstract

Apparati, computer-implemented methods, and computer-readable media for thwarting map-loaded module (8) attacks on a digital computer (1). Within the computer (1) is an intermediate location such as a registry (10) containing mappings from generic names (4) of map-loaded modules (8) to specific locations (5) of the map-loaded modules (8). Coupled to the intermediate location (10) is a monitor module (20) adapted to monitor attempts to replace existing mappings (5) of map-loaded modules (8) with replacement mappings (5). Coupled to the map-loaded modules (8) is a file system monitor;module (70) adapted to monitor attempts to insert new map-loaded modules (8) into the computer (1). Coupled to the monitor module (20) and to the file system monitor module (70) is a programmable control module (30) adapted to determine when a change in mapping constitutes a malicious code attack.

Claims19

Dependent claims

Computer apparatus comprising:

an intermediate location containing mappings from generic map-loaded module names to specific locations of map-loaded modules;
coupled to the intermediate location and to the map-loaded modules, a monitor adapted to monitor changes in mappings from the intermediate location to the map-loaded modules;
and
coupled to the monitor, a programmable control module adapted to make a determination that a change in mapping is deemed to constitute a malicious code attack when at least one pre-established rule is satisfied.

1 more element

Dependencies are inferred from the claim text.

Thwarting malicious registry mapping modifications and map-loaded module masquerade attacks

Life of this patent

Thwarting malicious registry mapping modifications and map-loaded module masquerade attacks

Life of this patent

Abstract

Claims19