US 9,807,113 B2Granted

Polymorphic obfuscation of executable code

OwnerSiying Yang, Jarrod Overson +2inventors

InventorsSiying Yang, Jarrod Overson, Ben Vinegar, Bei Zhang

Life of this patent

Estimating the term…

Loading patent…

Abstract

This document generally relates to systems, method, and other techniques for identifying and interfering with the operation of computer malware, as a mechanism for improving system security. Some implementations include a computer-implemented method by which a computer security server system performs actions including receiving a request for content directed to a particular content server system; forwarding the request to the particular content server system; receiving executable code from the particular content server system; inserting executable injection code into at least one file of the executable code; applying a security countermeasure to the combined executable code and executable injection code to create transformed code; and providing the transformed code to a client computing device.

Claims22

Dependent claims

A computer-implemented method, comprising:

in response to a first request, from a first client computing device, for a particular set of executable code:
inserting into the particular set of executable code, at one or more first locations based on a first map, and to create a first set of combined code, a set of executable injection code that, when executed by the first client computing device, does not (i) alter, from a user's perspective, an execution of the particular set of executable code, or (ii) perform actions observable by a user;
wherein the first map defines the one or more first locations where, in the particular set of executable code, the set of executable injection code will be inserted when served to a requesting client computing device;
providing the first set of combined code to the first client computing device;
and
generating a second map that defines one or more second locations where, in the particular set of executable code, the set of executable injection code will be inserted, wherein at least one location is different between the first map and the second map;
in response to receiving a second request from a second client computing device, inserting into the particular set of executable code, at the one or more second locations based on the second map, to create a second set of combined code, the set of executable injection code;
providing the second set of combined code to the second client computing device.

5 more elements

A computing system comprising:

one or more computers and one or more storage devices storing instructions that are operable, when executed by the one or more computers, to cause performance of a set of operations comprising:
in response to a first request, from a first client computing device for a particular set of executable code:
inserting into the particular set of executable code, at one or more first locations based on a first map, and to create a first set of combined code, a set of executable injection code that, when executed by the first client computing device, does not (i) alter, from a user's perspective, an execution of the particular set of executable code, or (ii) perform actions observable by a user;
wherein the first map defines the one or more first locations where, in the particular set of executable code, the set of executable injection code will be inserted when served to a requesting client computing device;
and
providing the first set of combined code to the first client computing device;
generating a second map that defines one or more second locations where, in the particular set of executable code, the set of executable injection code will be inserted, wherein at least one location is different between the first map and the second map;
in response to receiving a second request from a second client computing device, inserting into the particular set of executable code, at the one or more second locations based on the second map, to create a second set of combined code, the set of executable injection code;
providing the second set of combined code to the second client computing device.

6 more elements

One or more non-transitory computer-readable devices storing instructions that, when executed by one or more computer processors, cause performance of a set of operations comprising:

in response to a first request, from a first client computing device, for a particular set of executable code:
inserting into the particular set of executable code, at one or more first locations based on a first map, and to create a first set of combined code, a set of executable injection code that, when executed by the first client computing device, does not (i) alter, from a user's perspective, an execution of the particular set of executable code, or (ii) perform actions observable by a user;
wherein the first map defines the one or more first locations where, in the particular set of executable code, the set of executable injection code will be inserted when served to a requesting client computing device;
providing the first set of combined code to the first client computing device;
and
generating a second map that defines one or more second locations where, in the particular set of executable code, the set of executable injection code will be inserted, wherein at least one location is different between the first map and the second map;
in response to receiving a second request from a second client computing device, inserting into the particular set of executable code, at the one or more second locations based on the second map, to create a second set of combined code, the set of executable injection code;
providing the second set of combined code to the second client computing device.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/841,013Filed 31 Aug 2015
Published: US 2017/0063923 A12 Mar 2017
Granted: 31 Oct 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/1483
Countermeasures against malicious traffic: service impersonation, e.g. phishing, pharming or web spoofing
G06F 21/54
During program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow: by adding security routines or objects to programs
G06F 21/56
Detecting local intrusion or implementing counter-measures: computer malware detection or handling, e.g. anti-virus arrangements
H04L 63/1466
Countermeasures against malicious traffic: active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g.…