US 8,819,822 B1 · Security method for detecting intrusions that exploit misinterpretation of supplied data

Abstract

Mechanisms have been developed for securing computational systems against certain forms of attack. In particular, it has been discovered that, by scanning an input string for subsequences contained therein and configuring the computational system to generate a fault (or other triggered event) coincident with access to a memory location corresponding to one or more possible interpretations of data contained in the input string, it is possible to detect and/or interdict many forms of attack. For example, some realizations may scan for subsequences susceptible to interpretation as valid, canonical addresses, or as addresses in ranges that contain code, the stack, the heap, and/or system data structures such as the global offset table. Some realizations may scan for subsequences susceptible to interpretation as format strings or as machine code or code (source or otherwise) that could be executed in an execution environment (such as a Java™ virtual machine) or compiled for execution.

Drawings

Drawings are temporarily unavailable. Open the PDF at USPTO

Drawings

Claims30

Dependent claims

A security method for a computational system, the computational system including a memory system storing an application, a processor for executing the application, and an input/output system for receiving an input string, the method comprising:

scanning the input string for subsequences contained therein, wherein each subsequence corresponds to one or more possible interpretations of data contained in the input string;
identifying one of the subsequences of the input string that can be interpreted as a memory address;
configuring the computational system to trigger an exception coincident with access to a particular memory location corresponding to the memory address in the identified subsequence;
allowing the application to execute on the processor and receive the input string;
and
executing a handler routine when the exception is triggered by an access to the particular memory location corresponding to the memory address, the handler being configured to determine whether a security action should be taken and to perform the security action when the security action should be taken.

3 more elements

A machine readable data storage medium, the medium embodying virtualization software for execution on system hardware that includes system memory, a processor, a memory management unit, and a input/output interface, the virtualization software being configured to execute a virtual machine, the virtual machine including virtual system hardware and guest software that includes a guest operating system, and a guest application, the guest software executing on a virtual CPU implemented as part of the virtual system hardware by the virtualization software, the virtualization software further being configured to perform a method comprising:

scanning input strings presented to the virtual machine at a virtualized device interface, the scanning identifying subsequences contained therein, each subsequence corresponding to one or more possible interpretations of data contained in the input string;
identifying one of the subsequences of the input string that can be interpreted as a memory address;
configuring the system hardware to trigger an exception coincident with an access to a particular memory location corresponding to the memory address in the identified subsequence;
allowing the guest system software to execute and receive the input string;
and
responsive to the exception being triggered by an access to the particular memory location corresponding to the memory address, determining whether a security action is required and initiating or performing the security action when the security action is determined to be required.

3 more elements

Dependencies are inferred from the claim text.

Description10,431 words

Summary883 words

#1. Field of the Invention

#The present invention relates generally to computational systems and, more particularly, to security techniques for identifying and (in some cases) interdicting information system intrusions.

#2. Description of the Related Art

Brief description of the drawings5 figures

#The present invention may be better understood, and its numerous objects, features, and advantages made apparent to those skilled in the art by referencing the accompanying drawings.

#FIG. 1 depicts a network of computer systems in which techniques of the present invention may be employed.

#FIG. 2 illustrates the flow of input data bearings subsequences that may constitute or contribute to an intrusion attempt.

Detailed description9,417 words

#The use of the same reference symbols in different drawings indicates similar or identical items.

#Mechanisms have been developed for configuring an intrusion detection system to identify possible exploitations of data identified in inputs. In particular, techniques have been developed for identifying subsequences susceptible to malicious exploitation in the course of a given computation and for configuring the computation (or computational system) to trigger an evaluation and/or response when certain execution conditions suggest use of data or code implicated by the identified subsequences. The developed techniques are particularly effective against exploit strategies employed by some of most devastating Internet worms from 1988 to present.

#The method(s) by which we discover an attack differ(s) significantly from conventional intrusion detection methods, which typically scan for signatures or require examination of source or binary code prior to execution. Instead, we identify data in input streams that could be misinterpreted (or maliciously exploited) and take specific steps to react to such misinterpretations (or exploits) if and when they occur. In this sense, our techniques are data-centric, rather than code-centric. Our techniques can be employed to allow most modern CPUs to execute all the binary code in the system without examination of the binaries or corresponding source codes. We employ advanced but now-commonplace hardware features to transfer control to trusted code if certain “suspicious” or “dangerous” actions are taken during the execution of the original code. Our techniques are applicable to exploits that involve operating system code as well as applications.

Facts

Application

11/395,817Filed 30 Mar 2006

Granted

26 Aug 2014

Term ends

31 Jul 2031

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment, including 1,949 days of adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification2 codes

G06F 21/562
Computer malware detection or handling, e.g. anti-virus arrangements: static detection
G06F
Computing and data processing

Timeline

30 Mar 2006Application filedUS 11/395,817
30 Mar 2006Assigned to Vmware, Inc.assignment of assignor's interest
26 Aug 2014GrantedUS 8,819,822 B1
15 Apr 2024Assigned to Vmware LLCchange of name
12 Oct 2026TodayWithin its term
31 Jul 2031Term endsEstimated, includes 1,949 days of adjustment

Security method for detecting intrusions that exploit misinterpretation of supplied data

Life of this patent

Security method for detecting intrusions that exploit misinterpretation of supplied data

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims30

Description10,431 words

Drawings

Description10,431 words

Classification2 codes

Life of this patent