Method and system for protecting against unknown malicious activities by detecting a heap spray attack on an electronic device
AssigneeMcAfee, Inc.
InventorsJ. McEnroe Samuel Navaraj, Rahul C. Kashyap
Life of this patent
Estimating the term…
Abstract
A method and system for protecting against unknown malicious activities by detecting a heap spray attack on a electronic device are disclosed. A script is received at an electronic device from a remote device via a network and a loop operation is detected in the script that contains a write operation operable to write data to a memory of the electronic device. The amount of the data operable to be written to the memory by the write operation is determined and the data is prevented from being written to the memory if the amount of the data is greater than or equal to a threshold.
Claims24
A method for detecting malware, comprising:
- receiving data at an electronic device from a remote device via a network;
- detecting a loop operation in the data that contains a write operation operable to write data to a memory of the electronic device;
- and
- determining an amount of the data to be written to the memory by the write operation;
- and
- based at least on a determination that the amount of the data is greater than or equal to a threshold, identifying the write operation as potential malware and preventing the data from being written to the memory.
An apparatus for detecting malware, comprising:
- a processor;
- a computer readable memory communicatively coupled to the processor;
- and
- a monitor including instructions in the computer readable memory, the processing instructions, when executed by the processor, configure the monitor to:
- receive data at an electronic device from a remote device via a network;
- detect a loop operation in the data that contains a write operation operable to write data to a memory of the electronic device;
- determine an amount of the data to be written to the memory by the write operation;
- based at least on a determination that the amount of the data is greater than or equal to a threshold, identify the write operation as potential malware and prevent the data from being written to the memory;
- and
- based at least on a determination that the data is less than the threshold, allow the data to be executed.
At least one non-transitory computer readable medium storing instructions for detecting malware, the instructions, when executed by a processor, cause the processor to:
- receive data at an electronic device from a remote device via a network;
- detect a loop operation in the data that contains a write operation operable to write data to a memory of the electronic device;
- determine an amount of the data to be written to the memory by the write operation;
- based at least on a determination that the amount of the data is greater than or equal to a threshold, identify the write operation as potential malware and prevent the data from being written to the memory;
- and
- based at least on a determination that the data is less than the threshold, allow the data to be executed.
Dependencies are inferred from the claim text.