# US 9,519,533 B2 · Data flow tracking via memory monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,519,533 B2 - Document ID: US9519533B2 - Status: Granted - Kind: B2 - Application number: 14/607,251 - Filed: 2015-01-28 - Published: 2016-07-28 - Granted: 2016-12-13 - Earliest claimed: 2015-01-28 - Assignees: QUALCOMM Incorporated - Applicants: QUALCOMM Incorporated - Inventors: Man Ki Yoon; Mastooreh Salajegheh; Mihai Christodorescu; Yin Chen; Vinay Sridhara; Rajarshi Gupta - Web page: https://patentgrep.com/patent/US9519533B2 ## CPC - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 9/54: Interprogram communication - G06F 11/073: {in a memory management context, e.g. virtual memory or cache management (memory management G06F12/00; testing of static memory units G11C29/00)} - G06F 11/36: Prevention of errors by analysis, debugging or testing of software - G06F 11/3604: Analysis of software for verifying properties of programs (testing of software G06F11/3668) - G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)} - G06F 11/366: {using diagnostics (G06F11/0703 takes precedence)} - G06F 11/3668: Testing of software - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and devices for tracking data flows in a computing device include monitoring memory in a hardware component of the computing device to identify a read operation that reads information from a tainted memory address, using heuristics to identify a first, second, and third number of operations performed after the identified read operation, marking memory addresses of write operations performed after first number of operations and before the second number of operations as tainted, and marking memory addresses of write operations performed after the third number of operations and before the second number of operations as untainted. ## Claims ### Claim 1 A method of tracking data flows in a computing device, comprising: monitoring memory to identify a read operation that reads information from a tainted memory address; determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations; monitoring operations until one of: M operations are performed; and N write operations to untainted addresses are identified; marking memory addresses associated with identified write operations as tainted; and marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted. ### Claim 2 (depends on 1) The method of claim 1, further comprising using heuristics to identify the first, second and third number of operations. ### Claim 3 (depends on 1) The method of claim 1, further comprising: identifying a software application that reads information from one of the tainted memory addresses; and applying behavior information collected in the computing device to boosted decision stumps in a classifier model to determine whether the software application is non-benign. ### Claim 4 (depends on 1) The method of claim 1, further comprising: identifying a first software application that reads information from one of the tainted memory addresses; and monitoring application programming interface calls made by the first software application. ### Claim 5 (depends on 4) The method of claim 4, further comprising: generating a behavior vector information structure based on the monitored API calls; applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and using the behavior-based analysis results to determine whether the first software application is non-benign. ### Claim 6 (depends on 4) The method of claim 4, further comprising: identifying a second software application that reads information from one of the tainted memory addresses; and monitoring application programming interface calls made by the second software application. ### Claim 7 (depends on 6) The method of claim 6, further comprising: generating a behavior vector information structure based on a combination of API calls made by the first and second software applications; applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and using the behavior-based analysis results to determine whether behavior of the first and second software applications is non-benign. ### Claim 8 (depends on 7) The method of claim 7, wherein generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a collective behavior of the first and second software applications. ### Claim 9 (depends on 7) The method of claim 7, wherein generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a relationship between the first and second software applications. ### Claim 10 A non-transitory computer readable storage medium having stored thereon processor-executable software instructions configured to cause a processor of a computing device to perform operations comprising: monitoring memory to identify a read operation that reads information from a tainted memory address; determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations; monitoring operations until one of: M operations are performed; and N write operations to untainted addresses are identified; marking memory addresses associated with identified write operations as tainted; and marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted. ### Claim 11 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising using heuristics to identify the first, second and third number of operations. ### Claim 12 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising: identifying a software application that reads information from one of the tainted memory addresses; and applying behavior information collected in the computing device to boosted decision stumps in a classifier model to determine whether the software application is non-benign. ### Claim 13 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising: identifying a first software application that reads information from one of the tainted memory addresses; and monitoring application programming interface calls made by the first software application. ### Claim 14 (depends on 13) The non-transitory computer readable storage medium of claim 13, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising: generating a behavior vector information structure based on the monitored API calls; applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and using the behavior-based analysis results to determine whether the first software application is non-benign. ### Claim 15 (depends on 13) The non-transitory computer readable storage medium of claim 13, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising: identifying a second software application that reads information from one of the tainted memory addresses; and monitoring application programming interface calls made by the second software application. ### Claim 16 (depends on 15) The non-transitory computer readable storage medium of claim 15, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations further comprising: generating a behavior vector information structure based on a combination of API calls made by the first and second software applications; applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and using the behavior-based analysis results to determine whether behavior of the first and second software applications is non-benign. ### Claim 17 (depends on 16) The non-transitory computer readable storage medium of claim 16, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a collective behavior of the first and second software applications. ### Claim 18 (depends on 16) The non-transitory computer readable storage medium of claim 16, wherein the stored processor-executable software instructions are configured to cause a processor to perform operations such that generating the behavior vector information structure based on the combination of API calls made by the first and second software applications comprises generating an information structure that characterizes a relationship between the first and second software applications. ### Claim 19 A computing device, comprising: a processor configured with processor-executable instructions to perform operations comprising: monitoring memory to identify a read operation that reads information from a tainted memory address; determining an offset value (O) that identifies a first number of operations performed after the identified read operation, a monitoring window value (M) that identifies a second number of operations performed after the first number of operations, and an upper boundary value (N) that identifies a third number of operations performed after the first number of operations; monitoring operations until one of: M operations are performed; and N write operations to untainted addresses are identified; marking memory addresses associated with identified write operations as tainted; and marking memory addresses associated with write operations performed after the Nth operation and memory addresses associated with write operations performed after the Mth operation as untainted. ### Claim 20 (depends on 19) The computing device of claim 19, wherein the processor is configured with processor-executable instructions to perform operations further comprising: identifying a first software application that reads information from one of the tainted memory addresses; monitoring application programming interface calls made by the first software application; generating a behavior vector information structure based on the monitored API calls; applying the behavior vector information structure to a classifier model to generate behavior-based analysis results; and using the behavior-based analysis results to determine whether the first software application is non-benign.