Detecting heap-spray in memory images
AssigneePalo Alto Networks, Inc.
InventorsAlon Livne, Shlomi Levin, Gal Diskin
Life of this patent
Estimating the term…
Abstract
A computer is protected from heap spray attacks by identifying blocks in a heap memory, associating the blocks in buckets according to the block sizes, selecting one of the buckets, and choosing a first block and a second block from the selected bucket. The method is further carried out by making a content comparison of the first block with the second block, accumulating a positive result when the comparison meets a predetermined criterion of similarity, and reporting a heap spray detection when accumulated positive results exceed a predetermined threshold.
Claims19
A method for protecting a computer, comprising the steps of:
- executing in a computer processor application and system processes that allocate, utilize and deallocate a heap memory;
- while executing the application and system processes, the processor performing the steps of:
- identifying blocks having respective sizes in the heap memory;
- associating the blocks in buckets according to the sizes thereof;
- selecting one of the buckets;
- choosing a first block and a second block from the selected bucket;
- making a content comparison of the first block with the second block;
- accumulating a positive result when the comparison meets a predetermined criterion of similarity;
- and
- reporting a heap spray detection when the accumulated positive results in repeated performances of the steps of selecting, choosing, making a comparison and accumulating exceed a predetermined threshold.
A computer software product for computer protection, including a non-transitory computer-readable storage medium in which computer program instructions are stored, which instructions, when executed by a computer, cause the computer, while the computer is executing application and system processes that allocate, utilize and deallocate a heap memory, to perform the steps of:
- identifying blocks having sizes in the heap memory;
- associating the blocks in buckets according to the sizes thereof;
- selecting one of the buckets;
- choosing a first block and a second block from the selected bucket;
- making a content comparison of the first block with the second block;
- accumulating a positive result when the comparison meets a predetermined criterion of similarity;
- and
- reporting a heap spray detection when the accumulated positive results in repeated performances of the steps of selecting, choosing, making a comparison and accumulating exceed a predetermined threshold.
A data processing system, comprising:
- a processor;
- a memory accessible to the processor storing programs and data objects therein, the memory comprising a heap memory, the programs including a detection module and an alert module, wherein an invocation of the detection module causes the processor to perform the steps of:
- executing application and system processes that allocate, utilize and deallocate the heap memory;
- while executing the application and system processes, the processor:
- identifying blocks having sizes in the heap memory;
- associating the blocks in buckets according to the sizes thereof;
- selecting one of the buckets;
- choosing a first block and a second block from the selected bucket;
- making a content comparison of the first block with the second block;
- accumulating a positive result when the comparison meets a predetermined criterion of similarity;
- and
- invoking the alert module to report a heap spray detection when the accumulated positive results in repeated performances of the steps of selecting, choosing, making a comparison and accumulating exceed a predetermined threshold.
Dependencies are inferred from the claim text.