Method to detect application execution hijacking using memory protection

Patent metadata

Field	Value
Publication number	US-11244044-B1
Application number	US-201916277907-A
Country	US
Kind code	B1
Filing date	Feb 15, 2019
Priority date	Sep 30, 2015
Publication date	Feb 8, 2022
Grant date	Feb 8, 2022

Abstract

According to one embodiment, a malware detection software being loaded into non-transitory computer readable medium for execution by a processor. The malware detection software comprises exploit detection logic, rule-matching logic, reporting logic and user interface logic. The exploit detection logic is configured to execute certain event logic with respect to a loaded module. The rule-matching logic includes detection logic that is configured to determine whether an access source is attempting to access a protected region and determine whether the access source is from a dynamically allocated memory. The reporting logic includes alert generating logic that is configured to generate an alert while the user interface logic is configured to notify a user or a network administrator of a potential cybersecurity attack.

First claim

What is claimed is:

1. An electronic device, comprising:
one or more processors; and
a non-transitory storage medium communicatively coupled to the one or more processors, the non-transitory storage medium includes one or more software modules and logic that, upon execution by the one or more processors, performs operations comprising:
applying a page guard to an element of a stored software module of the one or more software modules, the page guard being code that detects a potential application-execution hijacking attack,
determining whether an access source is attempting to access the stored software module,
storing access events associated with the attempted access to the stored software module within a log file,
analyzing information associated with each of the stored access events corresponding to the attempted access within the log file by at least (i) conducting, in accordance with prescribed rules, an analysis of the information associated with the stored access events to produce a result, the result including a non-zero probability value of the stored access event is malicious, (ii) comparing the probability value to a prescribed threshold value, the attempted access is determined to be malicious based on, at least in part, a determination that the probability value exceeds a prescribed threshold value, and (iii) determining whether the access source is from a prescribed region of dynamically allocated memory, and
generating an alert when the result signifies that the attempted access is determined to be malicious, the alert comprises information associated with the access source being an object that, upon execution, is attempting to access the stored software module, the information includes a source of the access events and information associated with the dynamically allocated memory.

2. The electronic device of claim 1 , wherein the element of the stored software module comprises a base address of a loaded module.

3. The electronic device of claim 1 , wherein the element of the stored software module comprises the import table of the loaded module.

4. The electronic device of claim 1 , wherein the element of the stored software module comprises a process environment block.

5. The electronic device of claim 1 , wherein the alert to notify a user or a network administrator of the potential application-execution hijacking attack being a malicious access.

6. The electronic device of claim 1 , wherein the logic that, upon execution by the one or more processors, further performs the operations comprising:
terminating the loaded module so as to prevent an application-execution hijacking attack being a malicious access.

7. The electronic device of claim 1 , wherein the prescribed memory region associated with the dynamically allocated memory includes a heap.

8. The electronic device of claim 7 , wherein at least one of the access events associated with the attempted access includes an exception, the exception comprises context information including one or more register values at the time the exception was generated and the one or more register values correspond to an address of a source instruction that attempted to access the stored software module guarded by the page guard.

9. The electronic device of claim 8 , wherein the attempted access is malicious when the address of the source instruction correspond to an address of a heap.

10. A non-transitory storage medium including logic that, upon execution by the one or more processors, detects an application-execution hijacking, the non-transitory storage medium comprising:
logic to identify a loaded module stored in a memory;
logic to determine whether an access source is attempting to access the loaded module based on use a page guard applied to an element of the loaded module, the page guard being code that detects an attempted access to an address associated with the loaded module to detect a potential application-execution hijacking attack;
logic to raise an exception or memory access violation when a code attempts to access an address within the page guard, the attempted access corresponding to one or more access events;
logic to store the one or more access events within a log file,
logic to analyze information associated with each of the one or more access events within the log file by at least (i) conducting an analysis, in accordance with prescribed rules, on the information associated with the one or more access events to produce a result, the result including a non-zero probability value of the stored access event is malicious, (ii) comparing the probability value to a prescribed threshold value, the access being determined to be malicious based, at least in part, a determination that the probability value exceeds a prescribed threshold value, and (iii) determining on whether the access source is from a prescribed region of the memory associated with dynamically allocated memory, and
logic to generate an alert when the result signifies that the access is determined to be malicious, the alert comprises information associated with the access source being an object that, upon execution, is attempting to access the prescribed region of the memory, the information includes a source of the access events and a type of the memory.

11. The non-transitory storage medium of claim 10 , wherein the element of the loaded module comprises a base address of the loaded module.

12. The non-transitory storage medium of claim 10 , wherein the element of the loaded module comprises an import table of the loaded module.

13. The non-transitory storage medium of claim 10 , wherein the element of the loaded module comprises a process environment block being a data structure that is internally utilized by an operating system.

14. The non-transitory storage medium of claim 10 , wherein the alert to notify a user or a network administrator of the potential application-execution hijacking attack.

15. The non-transitory storage medium of claim 10 , wherein the logic that, upon execution by the one or more processors, further comprising:
logic to terminate the loaded module so as to prevent an application-execution hijacking attack.

16. The non-transitory storage medium of claim 10 , wherein the dynamically allocated memory corresponds to a heap.

17. The non-transitory storage medium of claim 16 , wherein the logic to generate the alert comprises logic that, upon execution by the one or more processors, generates the alert to communicate details of an access event.

18. A method comprising:
applying a page guard to an element of a stored software module of the one or more software modules, the page guard being code that detects a potential application-execution hijacking attack;
determining whether an access source is attempting to access the stored software module;
storing access events associated with the attempted access to the stored software module within a log file;

analyzing information associated with each of the stored access events corresponding to the attempted access within the log file by at least (i) conducting, in accordance with prescribed rules, an analysis of the information associated with the stored access events to produce a result, the result including a non-zero probability value of the stored access event is malicious, (ii) comparing the probability value to a prescribed threshold value, the attempted access is determined to be malicious based on, at least in part, a determination that the probability value exceeds a prescribed threshold value, and (iii) determining whether the access s

Assignees

• Fireeye Inc
• Fireeye Security Holdings Us Llc

Inventors

• Malik Amit
• Pande Raghav
• Jain Aakash

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• H04W12/128

  Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title