Computer security systems and methods using asynchronous introspection exceptions

A non-transitory computer-readable medium storing processor instructions which, when executed by a hardware processor of a host system, cause the host system to form a synchronous exception analyzer and an asynchronous exception analyzer, wherein the hardware processor is configured to:

• in response to detecting an occurrence of an event caused by an execution of the target entity, suspend the execution of the target entity, and
• in response to suspending execution of the target entity, switch to executing the synchronous exception analyzer;
• wherein the synchronous exception analyzer is configured to:
• determine whether the target entity is suspect of malice according to the event,
• in response, when the target entity is suspect of malice, selectively retrieve a rule exception signature from a plurality of rule exception signatures, the rule exception signature retrieved according to the event, wherein the rule exception signature comprises an encoding of a first condition and an encoding of a second condition,
• in response to retrieving the rule exception signature, determine whether the first condition is satisfied according to the event and according to the target entity,
• in response to determining whether the first condition is satisfied, when the first condition is satisfied, cause the hardware processor to resume execution of the target entity, and
• in response to determining whether the first condition is satisfied, when the first condition is not satisfied, determine that the target entity is malicious;
• and
• wherein the asynchronous exception analyzer is configured to:
• in response to the hardware processor resuming execution of the target entity, determine whether the second condition is satisfied according to the event and according to the target entity,
• in response to determining whether the second condition is satisfied, when the second condition is satisfied, determine that the target entity is not malicious, and
• in response to determining whether the second condition is satisfied, when the second condition is not satisfied, determine that the target entity is malicious.

A method of protecting a host system against computer security threats, the host system comprising a hardware processor and a memory, the method comprising:

• employing the hardware processor to detect an occurrence of an event caused by an execution of a target entity;
• in response to detecting the occurrence of the event, employing the hardware processor to suspend the execution of the target entity;
• in response to suspending the execution of the target entity, employing the hardware processor to switch to executing a synchronous exception analyzer configured to:
• determine whether the target entity is suspect of malice according to the event,
• in response, when the target entity is suspect of malice, selectively retrieve a rule exception signature from a plurality of rule exception signatures, the rule exception signature retrieved according to the event, wherein the rule exception signature comprises an encoding of a first condition and an encoding of a second condition,
• in response to retrieving the rule exception signature, determine whether the first condition is satisfied according to the event and according to the target entity,
• in response to determining whether the first condition is satisfied, when the first condition is satisfied, cause the hardware processor to resume execution of the target entity, and
• in response to determining whether the first condition is satisfied, when the first condition is not satisfied, determine that the target entity is malicious;
• in response to the hardware processor resuming execution of the target entity, employing the hardware processor to determine whether the second condition is satisfied according to the event and according to the target entity;
• in response to determining whether the second condition is satisfied, when the second condition is satisfied, determining that the target entity is not malicious;
• and
• in response to determining whether the second condition is satisfied, when the second condition is not satisfied, determining that the target entity is malicious.