Method to detect application execution hijacking using memory protection

Patent metadata

Field	Value
Publication number	US-10210329-B1
Application number	US-201514871987-A
Country	US
Kind code	B1
Filing date	Sep 30, 2015
Priority date	Sep 30, 2015
Publication date	Feb 19, 2019
Grant date	Feb 19, 2019

Abstract

According to one embodiment, a system comprising a dynamic analysis server comprising one or more virtual machines is disclosed, wherein the one or more virtual machines may be configured to execute certain event logic with respect to a loaded module. The virtual machines may be communicatively coupled to a virtual machine manager and a database; and rule-matching logic comprising detection logic, wherein the detection logic is configured to determine (1) whether an access source is attempting to access a protected region such as a page guarded area; and (2) determine whether the access source is from the heap. The system further comprises reporting logic that is configured to generate an alert so as to notify a user and/or network administrator of a probable application-execution hijacking attack.

First claim

What is claimed is:

1. An electronic device, comprising:
one or more hardware processors; and
a non-transitory computer-readable storage medium communicatively coupled to the one or more hardware processors, the non-transitory computer-readable storage medium having stored thereon logic that, upon execution by the one or more hardware processors, performs operations comprising:
identifying a loaded module,
applying a protection mechanism to an element of the loaded module so as to establish a protected region, wherein the element of the loaded module is one of a base address of the loaded module, an import table of the loaded module or a process environment block of the loaded module,
determining whether an access source is attempting to access the protected region,
determining whether the access source is from the heap, and
determining the access source is malicious based on determining the access source is attempting to access the protected region and is from the heap.

2. The electronic device of claim 1 , wherein the execution by the one or more hardware processors performs operations further comprising generating an alert so as to notify a user or a network administrator of a probable application-execution hijacking attack.

3. The electronic device of claim 1 , wherein the execution by the one or more processors performs operations further comprising terminating the loaded module so as to prevent an application-execution hijacking attack.

4. The electronic device of claim 1 , wherein the execution by the one or more processors performs operations further comprising generating a log file.

5. The electronic device of claim 1 , wherein the loaded module includes executable code.

6. An electronic device, comprising:
one or more hardware processors; and
a non-transitory computer-readable storage medium communicatively coupled to the one or more hardware processors, the non-transitory computer-readable storage medium having stored thereon logic that, upon execution by the one or more hardware processors, performs operations comprising:
identifying a loaded module,
applying a protection mechanism to an import table of the loaded module so as to establish a protected region,
determining whether an access source is attempting to access the protected region,
determining whether the access source is from the heap,
determining whether the access source is from the loaded module and accessing its own import address table, and
determining the access source is malicious based on determining the access source is (i) attempting to access the protected region, (ii) from the heap, and (iii) accessing its own import address table.

7. The electronic device of claim 5 , wherein the loaded module comprises one or more dynamic-link libraries (DLLs) that provide a scripting environment to applications.

8. The electronic device of claim 6 , wherein the loaded module includes executable code.

9. A system comprising:
a dynamic analysis server comprising one or more hardware processors, a non-transitory computer-readable storage medium and one or more virtual machines that are configured to execute event logic with respect to a loaded module, wherein the one or more virtual machines are communicatively coupled to a virtual machine manager and a database;
rule-matching logic comprising detection logic configured to be executable by the one or more hardware processors to determine whether (1) an access source is attempting to access a protected region, and (2) the access source is from the heap; and
reporting logic comprising alert generating logic that is configured to generate an alert so as to notify a user or a network administrator of a probable application-execution hijacking attack.

10. The system of claim 7 , further comprising process handling logic that is configured to terminate a potentially malicious loaded module.

11. The system of claim 7 , wherein the detection logic is configured to determine whether a protected page is being accessed, and whether the access source is from the heap.

12. The system of claim 9 , wherein the detection logic is configured to determine whether the loaded module is accessing its own import table.

13. The system of claim 9 , wherein the loaded module includes executable code.

14. The system of claim 9 , wherein further comprising dynamic-link library (DLL)/kernel logic that modularizes a software program into separate components.

15. A system comprising:
a mobile device configured to execute a malware detection application thereon, the detection application comprising:
exploit detection logic configured to execute certain event logic with respect to a loaded module;
rule-matching logic comprising detection logic configured to determine whether an access source is attempting to access a protected region and determine whether the access source is from the heap;
reporting logic comprising alert generating logic that is configured to generate an alert; and
user interface logic that is configured to notify a user or a network administrator of a probable application-execution hijacking attack.

16. The system of claim 11 , wherein the exploit detection logic is configured to terminate the loaded module.

17. The system of claim 11 , wherein the exploit detection logic is configured to generate an alert.

18. The system of claim 15 , further comprising process handling logic that is configured to terminate a potentially malicious loaded module.

19. The system of claim 15 , wherein the loaded module includes executable code.

20. The system of claim 15 , wherein further comprising dynamic-link library (DLL)/kernel logic that modularizes a software program into separate components.

Assignees

• Fireeye Inc

Inventors

• Malik Amit
• Pande Reghav
• Jain Aakash

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title