System and method for detecting malicious code

An apparatus for detecting malicious code in a computing system, comprising:

• a memory storing a set of instructions;
• a memory management unit mapping bus addresses;
• and
• one or more peripheral computing devices in communication with the memory and the memory management unit and separate from the memory management unit, the one or more peripheral computing devices to:
• request a translation of a bus address for a given device from the memory management unit;
• determine whether the requested translation was received from the memory management unit;
• if the requested translation was received from the memory management unit, determine whether the received translated bus address for the given device matches a physical address for the given device;
• and
• if the received translated bus address for the given device does not match the physical address for the given device, provide for sending a notification that the computing system is potentially compromised.

A non-transitory computer readable medium storing instructions executable by one or more computing devices to perform a method for detecting malicious code in a system, the method comprising:

• requesting a translation of a bus address mapped by an input/output memory management unit (IOMMU) for a given device, the IOMMU being separate from the one or more computing devices;
• determining whether the requested translation was received from the IOMMU;
• if the requested translation was received from the IOMMU, determining whether the received translated bus address for the given device matches a physical address for the given device;
• and
• if the received translated bus address for the given device does not match the physical address for the given device, sending a notification that the system is potentially compromised.