Intel Corporation

Other

Abhay Kanhere

Paul Caprioli

Muawya M Al-Otoom

Koichi Yamada

Saurabh Shukla

Suriya Subramanian

Aravind Subramanian

Ravi L Sahita

Xiaoning Li

Jeffrey J Cook

Mingwei Zhang

Suresh Srinivas

Rakesh Krishnaiyer

Yi Gai

Jayant Shukla

Omar M Shaikh

Chih-Yuan Yang

Somnath Ghosh

Suriya Madras-Subramanian

Wei Ey Li

Matthew C Merten

Dattatraya Kulkarni

Paul Henry Hohensee

Arvind Krishnaswamy

John Ng

Chu-Cheow Lim

Vivek Thakkar

Srinivas Suresh

Kiran Thirumalai

Haitao Feng

Pawel Osciak

Wessam M Hassanein

A malicious object detection system for use in managed runtime environments includes a check circuit to receive call information generated by an application, such as an Android application. A machine learning circuit coupled to the check circuit applies a machine learning model to assess the information and/or data included in the call and detect the presence of a malicious object, such as malware or a virus, in the application generating the call. The machine learning model may include a global machine learning model distributed across a number of devices, a local machine learning model based on use patterns of a particular device, or combinations thereof. A graphical user interface management circuit halts execution of applications containing malicious objects and generates a user perceptible output.

Malicious object detection in a runtime environment

In another aspect, method useful for monitoring of an API/system call implemented by an application for generating disassembly of an executable binary of the application, includes the steps of scanning a computer system for an executable application. The method includes the step of scanning the computer system for a running process associated with the executable binary. The method includes the step of initiating an application programming interface (API) call monitoring method that associates an observed API/system call with the executable binary. The method includes the step of reporting a set of collected events to a local server.

Methods and systems of disassembling executable code

In one aspect, a computer-implemented method for monitoring and validating execution of an executable binary code, includes the step of, prior to beginning execution of the executable binary code, disassembling the executable binary code, listing all of application programming interfaces (API) or function calls in the executable binary code, generating a validation table for a type of each of the APIs or each of the function calls, a location of each of the APIs or each of the function calls, and a return address of each of the APIs or each of the function calls in the executable binary code, and listing in the validation table the type of each of the APIs or each of the function calls.

System and method for exploiting attack detection by validating application stack at runtime

A data processing system (DPS) supports control-flow integrity (CFI). The DPS comprises a processing element with a CFI enforcement mechanism that supports one or more CFI instructions. The DPS also comprises at least one machine-accessible medium responsive to the processing element. Managed code in the machine-accessible medium is configured (a) to execute in a managed runtime environment (MRE) in the data processing system, and (b) to transfer control out from the MRE to unmanaged code, in response to a transfer control statement in the managed code. The machine-accessible medium also comprises a binary translator which, when executed, converts unmanaged code in the data processing system into hardened unmanaged code (HUC) by including CFI features in the HUC. The CFI features comprise one or more CFI instructions to utilize the CFI enforcement mechanism of the processing element for transfers of control initiated by the HUC. Other embodiments are described and claimed.

Control-flow integrity with managed code and unmanaged code

A micro-architecture may provide a hardware and software co-designed dynamic binary translation. The micro-architecture may invoke a method to perform a dynamic binary translation. The method may comprise executing original software code compiled targeting a first instruction set, using processor hardware to detect a hot spot in the software code and passing control to a binary translation translator, determining a hot spot region for translation, generating the translated code using a second instruction set, placing the translated code in a translation cache, executing the translated code from the translated cache, and transitioning back to the original software code after the translated code finishes execution.

Instruction and logic to perform dynamic binary translation

State recovery methods and apparatus for computing platforms are disclosed. An example method includes inserting, with a processor, a first instruction into optimized code to cause a first portion of a register in a first state to be saved to memory before execution of a region of the optimized code, maintaining, with the processor, a first indication of a first manner in which the first portion of the register is to be restored in connection with a state recovery after execution of the region of the optimized code, and maintaining, with the processor, a second indication of a second manner in which a second portion of the register is to be restored in connection with the state recovery after execution of the region of the optimized code.

State recovery methods and apparatus for computing platforms

An apparatus and method is described herein for providing structures to support software memory re-ordering within atomic sections of code. Upon a start or end of a critical section, speculative bits of a translation buffer are reset. When a speculative memory access causes an address translation of a virtual address to a physical address, the translation buffer is searched to determine if another entry (a different virtual address) includes the same physical address. And if another entry does include the same physical address, the speculative execution is failed to provide protection from invalid execution resulting from the memory re-ordering.

Method, apparatus, and system for efficiently handling multiple virtual address mappings during transactional execution canceling the transactional execution upon conflict between physical addresses of transactional accesses within the transactional execution

A vector reduction instruction is executed by a processor to provide efficient reduction operations on an array of data elements. The processor includes vector registers. Each vector register is divided into a plurality of lanes, and each lane stores the same number of data elements. The processor also includes execution circuitry that receives the vector reduction instruction to reduce the array of data elements stored in a source operand into a result in a destination operand using a reduction operator. Each of the source operand and the destination operand is one of the vector registers. Responsive to the vector reduction instruction, the execution circuitry applies the reduction operator to two of the data elements in each lane, and shifts one or more remaining data elements when there is at least one of the data elements remaining in each lane.

Accelerated interlane vector reduction instructions

Technologies for native code invocation using binary analysis are described. A computing device for invoking native code from managed code using binary analysis receives a call from a thread executing a managed code segment to execute a native code segment. The computing device performs a binary analysis of the native code segment and generates, from the binary analysis, a complexity indicator that indicates a level of complexity of the native code segment by comparing the native code segment to at least one predefined complexity rule. Additionally, the computing device stores a status of the thread based on the complexity indicator and executes the native code segment. Other embodiments are described and claimed.

Technologies for native code invocation using binary analysis

A hardware profiling mechanism implemented by performance monitoring hardware enables page level automatic binary translation. The hardware during runtime identifies a code page in memory containing potentially optimizable instructions. The hardware requests allocation of a new page in memory associated with the code page, where the new page contains a collection of counters and each of the counters corresponds to one of the instructions in the code page. When the hardware detects a branch instruction having a branch target within the code page, it increments one of the counters that has the same position in the new page as the branch target in the code page. The execution of the code page is repeated and the counters are incremented when branch targets fall within the code page. The hardware then provides the counter values in the new page to a binary translator for binary translation.

Hardware profiling mechanism to enable page level automatic binary translation

State recovery methods and apparatus for computing platforms are disclosed. An example method includes inserting a first instruction into optimized code to cause a first portion of a register in a first state to be saved to memory before execution of a region of the optimized code; and maintaining a value indicative of a manner in which a second portion of the register in the first state is to be restored in connection with a state recovery from the optimized code.

Mechanisms for reducing memory access violations are disclosed. Sets of instructions may be identified and the identified sets of instructions may be re-translated or optimized to generate other sets of instructions. Execution of the other sets of instructions is analyzed to determine whether additional memory access violations occur. When additional memory access violations occur, further sets of instructions may be generated or re-translation/optimization of instructions may be disabled.

Growing community of inventors

Fremont, CA, United States of America

Abhay Kanhere