Hardware and software execution profiling

Patent metadata

Field	Value
Publication number	US-10055585-B2
Application number	US-201314129246-A
Country	US
Kind code	B2
Filing date	Aug 28, 2013
Priority date	Aug 28, 2013
Publication date	Aug 21, 2018
Grant date	Aug 21, 2018

Abstract

Technologies for assembling an execution profile of an event are disclosed. The technologies may include monitoring the event for a branch instruction, generating a callback to a security module upon execution of the branch instruction, filtering the callback according to a plurality of event identifiers, and validating a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction.

First claim

What is claimed:

1. A method for assembling an execution profile of an event, the method comprising:
monitoring a process invoked in response to the event for a branch instruction;
generating a callback to a security module upon execution of the branch instruction;
filtering the callback according to filtering criteria that is dependent on a plurality of identifiers associated with the event; and
validating, by the security module in response to the filtering criteria being met, a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction, the validation including determining whether the code segment is associated with a manipulation of return addresses associated with branch instructions.

2. The method of claim 1 , further comprising checking the code segment for use of return-oriented programming techniques.

3. The method of claim 1 , further comprising managing security policies for the system.

4. The method of claim 1 , further comprising monitoring the process invoked in response to the event for the branch instruction using binary translation-based techniques.

5. The method of claim 1 , further comprising providing an event trigger from a monitoring extension to a processor, the event trigger for use in monitoring the process invoked in response to the event for the branch instruction.

6. The method of claim 1 , further comprising providing an event trigger from a monitoring extension to a processor, the event trigger for use in monitoring the process invoked in response to the event for the branch instruction, wherein the event trigger comprises a trigger when an instruction of a particular type is executed.

7. The method of claim 1 , further comprising providing an event trigger from a monitoring extension to a processor, the event trigger for use in monitoring the process invoked in response to the event for the branch instruction, wherein the event trigger comprises a trigger invoking a registered callback for handling of the event.

8. A system for securing an electronic device, comprising:
a memory;
a processor; and
one or more security agents including instructions resident in the memory and operable for execution by the processor, wherein the security agents are configured to:
assemble an execution profile of an event;
monitor a process invoked in response to the event for a branch instruction;
generate a callback upon execution of the branch instruction;
filter the callback according to filtering criteria that is dependent on a plurality of identifiers associated with the event; and
validate, in response to the filtering criteria being met, a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction, the validation including determining whether the code segment is associated with a manipulation of return addresses associated with branch instructions.

9. The system of claim 8 , wherein the security agents are further configured to check the code segment for use of return-oriented programming techniques.

10. The system of claim 8 , wherein the security agents are further configured to access managing security policies for the system to assemble the execution profile.

11. The system of claim 8 , wherein the security agents are further configured to monitor the process invoked in response to the event for the branch instruction using binary translation-based techniques.

12. The system of claim 8 , wherein the security agents are further configured to access an event trigger from a monitoring extension of the processor to monitor the process invoked in response to the event for a branch instruction.

13. The system of claim 8 , wherein the security agents are further configured to access an event trigger from a monitoring extension of the processor to monitor the process invoked in response to the event for a branch instruction, the event trigger based upon an instruction of a particular type is executed.

14. The system of claim 8 , wherein the security agents are further configured to access an event trigger from a monitoring extension of the processor to monitor the process invoked in response to the event for a branch instruction, the event trigger invoking a registered callback for handling of the event.

15. At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the machine readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
assemble an execution profile of an event;
monitor a process invoked in response to the event for a branch instruction;
generate a callback to a security module upon execution of the branch instruction;
filter the callback according to filtering criteria that is dependent on a plurality of identifiers associated with the event; and
validate, by the security module in response to the filtering criteria being met, a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction, the validation including determining whether the code segment is associated with a manipulation of return addresses associated with branch instructions.

16. The medium of claim 15 , wherein the instructions further cause the processor to check the code segment for use of return-oriented programming techniques.

17. The medium of claim 15 , wherein the instructions further cause the processor to monitor the process invoked in response to the event for the branch instruction using binary translation-based techniques.

18. The medium of claim 15 , wherein the instructions further cause the processor to access an event trigger from a monitoring extension of the processor to monitor the process invoked in response to the event for a branch instruction.

19. The medium of claim 15 , wherein the instructions further cause the processor to access an event trigger from a monitoring extension of the processor to monitor the process invoked in response to the event for a branch instruction, the event trigger based upon an instruction of a particular type is executed.

20. The medium of claim 15 , wherein the instructions further cause the processor to access an event trigger from a monitoring extension of the processor to monitor the process invoked in response to the event for a branch instruction, the event trigger invoking a registered callback for handling of the event.

Assignees

• Intel Corp
• Mcafee Llc

Inventors

• Dalcher Greg William
• Sahita Ravi L
• Shanmugavelayutham Palanivelra
• Yamada Koichi
• Krishnaswamy Arvind

Classifications

• G06F21/566 Primary

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/554

  involving event detection and direct action · CPC title