Computer Security Systems And Methods Using Virtualization Exceptions
US-2015199514-A1 · Jul 16, 2015 · US
Exploit detection system with threat-aware microvisor
US9507935B2 · US · B2
| Field | Value |
|---|---|
| Publication number | US-9507935-B2 |
| Application number | US-201414229580-A |
| Country | US |
| Kind code | B2 |
| Filing date | Mar 28, 2014 |
| Priority date | Jan 16, 2014 |
| Publication date | Nov 29, 2016 |
| Grant date | Nov 29, 2016 |
How to read this patent
A practical reading order for non-experts. Skip the full description unless you need deep technical detail.
- Title
What the patent document calls the invention.
- Abstract
A short plain-language summary of the technical disclosure.
- Assignees and inventors
Who owns or filed the patent and who is credited as inventor.
- Key dates
Filing, priority, publication, and grant dates set the timeline.
- First independent claim
The legal scope of protection — read this for what is actually claimed.
- CPC / IPC classifications
Technology tags used to group this patent with similar filings.
- Citations and related patents
Prior art links and similar publications in this corpus.
Abstract
Official abstract text for this publication.
An exploit detection system deploys a threat-aware microvisor to facilitate real-time security analysis, including exploit detection and threat intelligence, of an operating system process executing on a node of a network environment. The microvisor may be organized as a main protection domain representative of the operating system process. In response to the process attempting to access a kernel resource for which it does not have permission, a capability violation may be generated at the main protection domain of the microvisor and a micro-virtual machine (VM) may be spawned as a container configured to encapsulate the process. The main protection domain may then be cloned to create a cloned protection domain that is representative of the process and that is bound to the spawned micro-VM. Capabilities of the cloned protection domain may be configured to be more restricted than the capabilities of the main protection domain with respect to access to the kernel resource. The restricted capabilities may be configured to generate more capability violations than those generated by the capabilities of the main protection domain and, in turn, enable further monitoring of the process as it attempts to access the kernel resource.
First claim
Opening claim text (preview).
What is claimed is: 1. A system comprising: a central processing unit (CPU) of an exploit detection system; a memory coupled to the CPU and configured to store: a threat-aware microvisor executable by the CPU to generate a capability violation in response to a process executing in an operating system attempting to access a kernel resource for which the process does not have permission, the threat-aware microvisor having a main protection domain including one or more execution c…
Assignees
Inventors
Classifications
- G06F21/552Primary
Physics · mapped topic
Physics · mapped topic
Physics · mapped topic
Physics · mapped topic
Physics · mapped topic
Patent family
Related publications grouped by family.
External sources
Next steps
Free tools are coming soon. Tell us what you want to track and we'll notify you.
Frequently asked questions
Answers are generated from the same data shown on this page.
- What does patent US9507935B2 cover?
- An exploit detection system deploys a threat-aware microvisor to facilitate real-time security analysis, including exploit detection and threat intelligence, of an operating system process executing on a node of a network environment. The microvisor may be organized as a main protection domain representative of the operating system process. In response to the process attempting to access a kern…
- Who is the assignee on this patent?
- Fireeye Inc
- What technology area does this patent fall under?
- Primary CPC classification G06F21/552. Mapped technology areas include Physics.
- When was this patent published?
- Publication date Tue Nov 29 2016 00:00:00 GMT+0000 (Coordinated Universal Time) (B2). Legal status and post-grant events are not shown on this page.
- What related patents are in patentsdb?
- We list 3 related publications on this page (citations in our corpus or others sharing the same primary CPC).