# US 9,436,823 B1 · System and method for detecting malicious code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,436,823 B1 - Document ID: US9436823B1 - Status: Granted - Kind: B1 - Application number: 14/109,005 - Filed: 2013-12-17 - Granted: 2016-09-06 - Earliest claimed: 2013-12-17 - Assignees: Google Inc. - Applicants: Google Inc. - Inventors: Benjamin Charles Serebrin; Brandon S. Baker - Web page: https://patentgrep.com/patent/US9436823B1 ## CPC - G06F 21/561: {Virus type analysis} - G06F 12/1027: using associative or pseudo-associative address translation means, e.g. translation look-aside buffer [TLB] - G06F 12/1081: for peripheral access to main memory, e.g. direct memory access [DMA] - G06F 21/567: {using dedicated hardware} - G06F 12/1072: Decentralised address translation, e.g. in distributed shared memory systems - G06F 2212/1052: Security improvement - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and apparatus are provided to detect malicious code in a computing system, where the malicious code is obscured by manipulation of an input/output memory management unit. A peripheral component interconnect express (PCIe) device requests a translation of a bus address for a given device in the system and determines whether the requested translation was received. If the requested translation was received, the PCIe device further determines whether the bus address for the given device corresponds to a physical address for the given device. If the bus address for the given device does not correspond to the physical address for the given device, the PCIe device sends a notification that the computing system is potentially compromised. ## Claims ### Claim 1 A method for detecting malicious code in a computing system, comprising: requesting, by one or more peripheral computing devices, a translation from an input/output memory management unit (IOMMU) of a bus address mapped by the IOMMU for a given device, wherein the IOMMU is separate from the one or more peripheral devices; determining, using the one or more peripheral computing devices, whether the requested translation was received from the IOMMU; if the requested translation was received at the one or more peripheral devices from the IOMMU, determining, using the one or more peripheral computing devices, whether the received translated bus address for the given device matches a physical address for the given device; and if the received translated bus address for the given device does not match the physical address for the given device, sending a notification that the computing system is potentially compromised. ### Claim 2 (depends on 1) The method of claim 1, further comprising: if the requested translation was not received, determining whether the requested translation was refused; and if the requested translation was refused, classifying the computing system as potentially compromised. ### Claim 3 (depends on 2) The method of claim 2, wherein determining whether the translation was refused comprises determining whether address translation services were disabled. ### Claim 4 (depends on 1) The method of claim 1, further comprising, if the bus address for the given device corresponds to the physical address for the given device, scanning a main memory using the provided translation associated with the given device for signatures of malicious code. ### Claim 5 (depends on 4) The method of claim 4, wherein scanning the main memory comprises at least one of transmitting sample data through the computing system and pattern matching. ### Claim 6 (depends on 1) The method of claim 1, wherein sending the notification comprises turning off a component in the computing system. ### Claim 7 (depends on 6) The method of claim 6, wherein turning off the component comprises turning off a network interface controller. ### Claim 8 (depends on 1) The method of claim 1, wherein sending the notification comprises issuing one or more of a visual or audio alert. ### Claim 9 (depends on 1) The method of claim 1, wherein sending the notification comprises transmitting data through the computing system. ### Claim 10 (depends on 1) The method of claim 1, wherein sending the notification comprises resetting the computing system. ### Claim 11 An apparatus for detecting malicious code in a computing system, comprising: a memory storing a set of instructions; a memory management unit mapping bus addresses; and one or more peripheral computing devices in communication with the memory and the memory management unit and separate from the memory management unit, the one or more peripheral computing devices to: request a translation of a bus address for a given device from the memory management unit; determine whether the requested translation was received from the memory management unit; if the requested translation was received from the memory management unit, determine whether the received translated bus address for the given device matches a physical address for the given device; and if the received translated bus address for the given device does not match the physical address for the given device, provide for sending a notification that the computing system is potentially compromised. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the one or more computing devices and memory are coupled to the computing system via a peripheral component interconnect express (PCIe) switch, the PCIe switch further coupled to an input/output memory management unit. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the one or more computing devices and memory are components within one of a network interface controller or a graphics processing unit. ### Claim 14 (depends on 12) The apparatus of claim 12, wherein the one or more computing devices and memory reside on one of a field programmable gate array or an application specific integrated circuit. ### Claim 15 (depends on 11) The apparatus of claim 11, further comprising a communication unit coupled to the one or more computing devices, the communication unit sending the notification that the computing system is potentially compromised. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the communication unit sends the notification by performing at least one of turning off a component in the computing system, resetting the computing system, issuing a visual or audio alert, or sending data through the computing system. ### Claim 17 (depends on 11) The apparatus of claim 11, wherein the one or more computing devices further determines whether the requested translation was refused, and classifies the computing system as potentially compromised if the requested translation was refused. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the one or more computing devices determines that the translation was refused if address translation services were disabled. ### Claim 19 (depends on 11) The apparatus of claim 11, wherein the one or more computing devices include a state machine. ### Claim 20 A non-transitory computer readable medium storing instructions executable by one or more computing devices to perform a method for detecting malicious code in a system, the method comprising: requesting a translation of a bus address mapped by an input/output memory management unit (IOMMU) for a given device, the IOMMU being separate from the one or more computing devices; determining whether the requested translation was received from the IOMMU; if the requested translation was received from the IOMMU, determining whether the received translated bus address for the given device matches a physical address for the given device; and if the received translated bus address for the given device does not match the physical address for the given device, sending a notification that the system is potentially compromised. ### Claim 21 (depends on 20) The non-transitory computer readable medium of claim 20, the method further comprising: if the requested translation was not received, determining whether the requested translation was refused; and if the requested translation was refused, classifying the system as potentially compromised. ### Claim 22 (depends on 20) The non-transitory computer readable medium of claim 20, wherein sending the notification comprises at least one of turning off a component in the system, issuing a visual or audio alert, or sending data through the system.