Method of detecting and blocking malicious activity

Patent metadata

Field	Value
Publication number	US-8959639-B2
Application number	US-13448108-A
Country	US
Kind code	B2
Filing date	Jun 6, 2008
Priority date	Jun 18, 2007
Publication date	Feb 17, 2015
Grant date	Feb 17, 2015

Abstract

A method of detecting and blocking malicious activity of processes in computer memory during unpacking of a file after the code and data contained in the file are unpacked is described. The method includes inserting a hook function into one or more un-assessed processes running in the computer memory. A hook is then placed on one or more system calls carried out by the one or more un-assessed processes; the one or more system calls determining an optimal time period in which to detect malicious activity in the un-assessed processes. During the optimal time period the one or more system calls carried out by the one or more un-assessed processes are suspended and attributes of the one or more un-assessed processes are detected and the likely maliciousness of the one or more un-assessed processes is determined from the attributes.

First claim

The invention claimed is:

1. A method of detecting and blocking malicious activity of processes in computer memory during unpacking of a file after the code and data contained in the file are unpacked, including the steps of:
(a) inserting a hook function into a process running in the computer memory, the hook function placing a hook on a system call carried out by the process;
(b) receiving a first inter-process communication (IPC) constructed by the hook function, the first IP…

Assignees

• Shevchenko Sergei
• Symantec Corp

Inventors

• Shevchenko Sergei

Classifications

• G06F21/56 Primary

  Physics · mapped topic

• G06F21/52

  Physics · mapped topic