Evaluating shellcode findings
AssigneeMicrosoft Corporation
InventorsJinwook Shin, John Joseph Lambert, Joshua Lackey
Life of this patent
Estimating the term…
Abstract
Concepts and technologies are described herein for evaluating shellcode findings. In accordance with the concepts and technologies disclosed herein, shellcode findings can be evaluated to determine if the shellcode findings are legitimate, or if the shellcode findings are false positive shellcode findings. Legitimate shellcode findings can be determined based not simply upon patterns associated with the suspected shellcode itself, but also based upon a pattern of bit-level entropy in the memory around the suspected shellcode. Mathematical models of the memory can be generated and analyzed to determine if the shellcode finding is legitimate.
Claims20
A computer-implemented method for evaluating a shellcode finding associated with a memory, the computer-implemented method comprising performing computer-implemented operations for:
- receiving, at a computer executing a test application, the shellcode finding;
- obtaining, at the computer, a plurality of samples from the memory, each of the samples being taken from a respective memory address;
- determining, at the computer, bit-level entropy values corresponding, respectively, to the bit-level entropy of the memory at the memory addresses corresponding to the respective samples;
- generating, at the computer, a shellcode curve that passes through the bit-level entropy values;
- fitting, at the computer, an optimal normal distribution graph to the shellcode curve;
- and
- analyzing, at the computer, the optimal normal distribution graph and the shellcode curve to determine if the shellcode finding is legitimate.
A computer-implemented method for evaluating a shellcode finding associated with a memory, the computer-implemented method comprising performing computer-implemented operations for:
- receiving, at a computer executing a test application, the shellcode finding, the shellcode finding comprising a memory address and being generated by a shellcode scanner in communication with the memory;
- obtaining, at the computer, a plurality of samples from the memory, each of the samples being obtained from respective memory addresses that are proximate to the memory address of the shellcode finding;
- determining, at the computer, a bit-level entropy value for each of the plurality of samples, the bit-level entropy values corresponding to bit-level entropy levels of the memory at the memory addresses of the plurality of samples;
- generating, at the computer, a cubic spline comprising a plurality of piecewise polynomials, each of the piecewise polynomials extending between two bit-level entropy values;
- fitting, at the computer, an optimal normal distribution graph to the cubic spline;
- and
- analyzing, at the computer, the optimal normal distribution graph and the cubic spline to determine if the shellcode finding is legitimate.
A computer-readable storage medium having computer readable instructions stored thereupon that, when executed by a computer, cause the computer to:
- receive the shellcode finding associated with a memory, the shellcode finding being generated by a shellcode scanner in communication with the memory;
- obtain a plurality of samples from the memory;
- determine a bit-level entropy value for each of the plurality of samples, the bit-level entropy values corresponding to bit-level entropy levels of the memory at memory addresses of the plurality of samples;
- generate a shellcode curve comprising a plurality of piecewise polynomials, each of the piecewise polynomials extending between two bit-level entropy values;
- fit an optimal normal distribution graph to the shellcode curve;
- calculate an absolute value of the difference between the optimal distribution graph and the shellcode curve;
- compare the absolute value to a threshold value;
- determine that the shellcode finding is legitimate, in response to determining that the absolute value is less than the threshold value;
- in response to determining that the absolute value is greater than the threshold value,
- fit a plurality of normal distribution graphs to the cubic spline,
- compute a plurality of difference values, each of the plurality of difference values comprising a difference between one of the plurality of normal distribution graphs and the cubic spline,
- derive a line function that represents the difference values,
- compare the line function to an expected pattern corresponding to a pattern for a line function associated with a legitimate shellcode finding, wherein
- the shellcode finding is confirmed as legitimate if
- a first of the two lines has a negative slope,
- a second of the two lines has a positive slope, and
- the global minimum is located proximate to the center of the domain of the line function, and
- the shellcode finding is not confirmed as legitimate if
- the first of the two lines does not have a negative slope, or
- the second of the two lines does not have a positive slope.
Dependencies are inferred from the claim text.