Detecting malware by monitoring client-side memory stacks

Patent metadata

Field	Value
Publication number	US-12229774-B2
Application number	US-202117240169-A
Country	US
Kind code	B2
Filing date	Apr 26, 2021
Priority date	Nov 8, 2017
Publication date	Feb 18, 2025
Grant date	Feb 18, 2025

Abstract

Methods and systems for detecting malware by monitoring client-side memory stacks are described. A request for a payment process is received and a client-side memory stack is populated with a series of functions corresponding to the requested payment process. The execution of each function is monitored to determine whether the series of functions and an order of execution of the functions from the client-side memory stack are the same as an expected series of functions and in an expected order corresponding to the payment process. The monitoring also determines whether the number and types of parameters called by the functions are the same as the expected number and types of parameters. The monitoring further determines whether the timing of the execution of the functions is the same as an expected timing. Remedial action is performed when the any of these factors is determined to be different than what is expected.

First claim

What is claimed is:

1. A system comprising:
one or more hardware processors; and
a non-transitory memory storing instructions that, when executed by the one or more hardware processors, causes the one or more hardware processors to perform operations comprising:
receiving, from a first application of a computing device that is not part of the system, a request for performing a payment process associated with an account;
monitoring, via a second application of the computing device, an execution of a set of functions from a client-side memory stack of the computing device, the client-side memory stack being populated with the set of functions corresponding to the payment process;
determining a malicious operating condition of the computing device based on the monitoring, wherein the determining the malicious operating condition of the computing device comprises determining that the set of functions being executed by the computing device from the client-side memory stack is different from an expected set of functions or that an order in which the set of functions is being executed by the computing device from the client-side memory stack is different from an expected order of execution of the set of functions corresponding to the payment process; and
in response to determining the malicious operating condition of the computing device, executing, via the second application, a remedial action on the computing device.

2. The system of claim 1 , wherein the client-side memory stack is a JavaScript stack.

3. The system of claim 1 , wherein the executing the remedial action comprises interrupting the execution of the set of functions.

4. The system of claim 3 , wherein the operations further comprise:
presenting a re-authentication challenge on the computing device;
receiving, via the computing device, authentication data associated with the re-authentication challenge;
authenticating a user of the computing device for using the account based on the authentication data; and
causing the computing device to resume the execution of the set of functions.

5. The system of claim 1 , wherein the operations further comprise identifying at least one function in the set of functions that is not included in the expected set of functions.

6. The system of claim 1 , wherein the operations further comprise in response to determining the malicious operating condition of the computing device, transmitting an alert to a device associated with one of an administrator or an owner of the account.

7. The system of claim 1 , wherein the operations further comprise sending a notification to a payment processing server hosting the account.

8. A method comprising:
receiving, from a first application of a computing device, a request for performing a payment process associated with an account;
monitoring, via a second application of the computing device, an execution of a set of functions from a client-side memory stack of the computing device, the client-side memory stack being populated with the set of functions corresponding to the payment process;
determining an operating condition of the computing device based on the monitoring, wherein the determining the operating condition comprises detecting that a set of parameters retrieved by the computing device based on executing a first function of the set of functions is different from an expected set of parameters associated with the payment process; and
executing, in response to determining the operating condition of the computing device, a remedial action.

9. The method of claim 8 , wherein the client-side memory stack is a JavaScript stack.

10. The method of claim 8 , wherein the executing the remedial action comprises interrupting the execution of the set of functions.

11. The method of claim 10 , further comprising:
presenting, on the computing device, a re-authentication challenge;
receiving, via the computing device, authentication data associated with the re-authentication challenge;
authenticating a user of the computing device for using the account based on the authentication data; and
causing the computing device to resume the execution of the set of functions.

12. The method of claim 8 , wherein an execution of each function in the set of functions causes the computing device to retrieve one or more parameters corresponding to the function.

13. The method of claim 8 , further comprising:
identifying a number of parameters retrieved by the computing device based on executing the first function; and
comparing the number against an expected number of parameters associated with the payment process.

14. The method of claim 8 , further comprising in response to determining the operating condition, transmitting an alert to a device associated with one of an administrator or an owner of the account.

15. A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause performance of operations comprising:
receiving, from a first application of a computing device, an indication that the computing device has initiated a payment process associated with an account;
monitoring, via a second application of the computing device, an execution of a set of functions from a client-side memory stack of the computing device, the client-side memory stack being populated with the set of functions corresponding to the payment process;
determining an operating condition of the computing device based on the monitoring, wherein the determining the operating condition comprises determining that an execution time of one function of the set of functions by the computing device is different from an expected execution time for a corresponding function of the payment process; and
executing, in response to determining the operating condition, a remedial action for the payment process.

16. The non-transitory machine-readable medium of claim 15 , wherein the client-side memory stack is a JavaScript stack.

17. The non-transitory machine-readable medium of claim 15 , wherein the executing the remedial action comprises interrupting the execution of the set of functions.

18. The non-transitory machine-readable medium of claim 17 , wherein the operations further comprise:
presenting, on the computing device, a re-authentication challenge;
receiving, via the computing device, authentication data associated with the re-authentication challenge; and
authenticating a user of the computing device for using the account based on the authentication data; and
causing the computing device to resume the execution of the set of functions.

19. The non-transitory machine-readable medium of claim 15 , wherein the operations further comprise:
measuring a time duration for the computing system to execute a first function of the set of functions; and
determining if the measured time duration falls within a known approximate window of time for executing the first function.

20. The non-transitory machine-readable medium of claim 14 , wherein the operations further comprise in response to determining the operating condition of the computing device, transmitting an alert to a device associated with one of an administrator or an owner of the account.

Assignees

• Paypal Inc

Inventors

• Boutnaru Shlomi

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• G06Q20/4016 Primary

  involving fraud or risk level assessment in transaction processing · CPC title

• G06Q20/4014 Primary

  Identity check for transactions · CPC title