Methods, media, and systems for detecting an anomalous sequence of function calls

A method for detecting an anomalous sequence of function calls, comprising:

• compressing a sequence of function calls made by the execution of a program using a compression model;
• determining the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed;
• in response to determining the presence of the anomalous sequence of function calls in the sequence of function calls, isolating a portion of the program that made the anomalous sequence of function calls;
• constructing a vaccine that makes the anomalous sequence of function calls non-anomalous;
• testing the vaccine in an instrumented version of the isolated portion of the program;
• and
• in response to verifying that the vaccine made the anomalous sequence of function calls non-anomalous, updating the program with the vaccine.

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting an anomalous sequence of function calls, the method comprising:

• compressing a sequence of function calls made by the execution of a program using a compression model;
• determining the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed;
• in response to determining the presence of the anomalous sequence of function calls in the sequence of function calls, isolating a portion of the program that made the anomalous sequence of function calls;
• constructing a vaccine that makes the anomalous sequence of function calls non-anomalous;
• testing the vaccine in an instrumented version of the isolated portion of the program;
• and
• in response to verifying that the vaccine made the anomalous sequence of function calls non-anomalous, updating the program with the vaccine.

A system for detecting an anomalous sequence of function calls, comprising:

• a memory;
• and
• a processor in communication with the memory;
• wherein the processor:
• compresses a sequence of function calls made by the execution of a program using a compression model, wherein the compression model is generated from sequences of observed function calls of known programs;
• and
• determines the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed.

A system for detecting an anomalous sequence of function calls, comprising:

• a memory;
• and
• a processor in communication with the memory, wherein the processor:
• compresses a sequence of function calls made by the execution of a program using a compression model;
• determines the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed;
• in response to determining the presence of the anomalous sequence of function calls in the sequence of function calls, isolates a portion of the program that made the anomalous sequence of function calls;
• constructs a vaccine that makes the anomalous sequence of function calls non-anomalous;
• tests the vaccine in an instrumented version of the isolated portion of the program;
• and
• in response to verifying that the vaccine made the anomalous sequence of function calls non-anomalous, updates the program with the vaccine.