Back to results
US 9,317,687 B2Granted
Identifying rootkits based on access permissions
AssigneeMcAfee, Inc.
InventorsJonathan L. Edwards, Aditya Kapoor, Michael S. Hughes
Life of this patent
Estimating the term…
Abstract
A method for monitoring for malware includes, during a boot process on an electronic device, determining a portion of memory, determining that the portion of memory is reserved for exclusive access by an entity on the electronic device, and, based on the determination that a portion of memory is reserved for exclusive access during the boot process, determining that the reservation is indicative of malware.
Claims17
A method for monitoring for malware, comprising:
- during a boot process on an electronic device, determining a portion of memory with a processor;
- during the boot process, determining that the portion of memory is reserved for exclusive access by an entity on the electronic device with the processor;
- and
- based at least on the determination that a portion of memory is reserved for exclusive access during the boot process, determining that the reservation is indicative of malware with the processor;
- wherein determining that the reservation is indicative of malware is made independent of determinations, made after the boot process has completed, that the portion of memory is reserved for exclusive access by the entity on the electronic device.
2 more elements
An article of manufacture, comprising:
- one or more non-transitory computer readable medium comprising computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
- during a boot process on an electronic device, determine a portion of memory;
- during the boot process, determine that the portion of memory is reserved for exclusive access by an entity on the electronic device;
- and
- based at least on the determination that a portion of memory is reserved for exclusive access during the boot process, determine that the reservation is indicative of malware;
- wherein causing the processor to determine that the reservation is indicative of malware is made independent of determinations, made after the boot process has completed, that the portion of memory is reserved for exclusive access by the entity on the electronic device.
3 more elements
A system for monitoring for malware, comprising:
- an electronic device including a portion of memory;
- a processor coupled to one or more computer readable medium, the computer-executable instructions carried on the computer readable medium, the instructions readable by the processor, the instructions, when read and executed, for causing the processor to:
- during a boot process on the electronic device, determine the portion of memory;
- during the boot process, determine that the portion of memory is reserved for exclusive access by an entity on the electronic device;
- and
- based at least on the determination that a portion of memory is reserved for exclusive access during the boot process, determine that the reservation is indicative of malware;
- wherein causing the processor to determine that the reservation is indicative of malware is made independent of determinations, made after the boot process has completed, that the portion of memory is reserved for exclusive access by the entity on the electronic device.
4 more elements
Dependencies are inferred from the claim text.