Mcafee, Inc.

International Business Machines Corporation

Lenovo (singapore) Pte. Ltd.

Balbir Singh

Rajbir Bhattacharjee

Andrew Russell Low

Prashanth K Nageshappa

Ratinder Paul Singh Ahuja

Dattatraya Kulkarni

Michael H Dawson

Kunal Mehta

Maneesh Soni

Saket Saurabh

Nitin Munjal

Shivasheesh

Simon R Hunt

Sathiskumar Palaniappan

Preet Mohinder

Manish Sharma

Ratnesh Pandey

Vaddagiri Srivatsa

Jaskaran Singh Khurana

Amritanshu Johri

Prasanna S Panchamukhi

Nitin Jaglan

Pankaj Singh

Rahul Chandra Khali

Particular embodiments described herein provide for an electronic device that includes a binder kernel driver. The binder kernel driver can be configured to receive an application program interface (API) call, extract metadata from the API call, determine that the API call should be hooked based on the extracted metadata, and hook the API call.

Detection of malicious invocation of application program interface calls

A computer implemented method for preventing return-oriented programming (ROP) attacks includes registering one or more critical regions, wherein a critical region corresponds to an address that has been selected to be monitored for potential ROP attacks, identifying one or more critical functions, wherein a critical function corresponds to a function that has been selected to be analyzed as a potential ROP threat, instrumenting the one or more critical regions with ROP protection mechanisms, detecting a critical function execution attempt on one or more of the identified critical regions, determining whether values associated with the critical function match corresponding expected values, and, responsive to determining that values associated with the critical function do not match expected values, activating a return-oriented programming protection mechanism.

Return oriented programming attack protection

Managed devices containing a Trusted Platform Module (TPM) to provide a trusted environment generate a device certificate at initialization of the TPM and send the device certificate to a management console for storing in a certificate database. Upon detecting a file of interest, the TPM signs the file, adding to a signature list created by previous managed devices. The signature list can be used to analyze the spread of the file across the system of managed devices, including tracking the file to the first managed device to have had a copy, without requiring real-time access to the managed devices during the spread of the file. In some embodiments, additional security measures may be taken responsive to determining the first managed device and the path the file has taken across the system of managed devices.

Using trusted platform module to build real time indicators of attack information

System calls to a kernel of a mobile computing device are monitored. A particular system call is intercepted relating to input/output (I/O) functionality of the mobile computing device. A data loss prevention (DLP) policy is identified that is applicable to the particular system call. An action is performed on the particular system call based at least in part on the DLP policy.

Data loss prevention for mobile computing devices

In an example, there is disclosed a security architecture for enhanced, non-invasive whitelisting of executable objects. When an executable object tries to perform an action, a security engine seamlessly intercepts the action and determines whether the action is whitelisted, blacklisted, or graylisted, assigning the action a corresponding security score. Whitelisted actions may be allowed, blacklisted actions may be disallowed, and graylisted actions may require additional verification from a user. Because the score is assigned to the combination of the executable object and the action, false positives may be avoided, such as those that may occur when an executable object is prefetched but has not yet tried to perform any useful work.

Non-invasive whitelisting

Technologies for prevention of forgery of a network communication request to a server include a system for security of a network communication request. The system includes a communication module configured to receive the network communication request from a client. The network communication request may have a content parameter. The communication module may be configured to generate a string of content parameters comprising the content parameters and a hash of the content parameter, and communicate portions of a result of the network communication request to the client incorporating the encrypted string of content parameters. Furthermore, the communication module may receive a subsequent request from the client. The subsequent request may be associated with the network communication request. As a result of authenticating the subsequent request, the communication module may complete the network communication request.

Prevention of forgery of web requests to a server

Techniques for dynamic instrumentation are provided. A method for instrumentation preparation may include obtaining address data of an original instruction in an original instruction stream, obtaining kernel mode data comprising a kernel breakpoint handler, obtaining user mode data comprising a user breakpoint handler, allocating a page of a process address space, creating a trampoline, associating the trampoline with a breakpoint instruction, and replacing the original instruction with the breakpoint instruction. A method for instrumentation may include detecting the breakpoint instruction, calling the kernel breakpoint handler, modifying an instruction pointer via the kernel breakpoint handler such that the instruction pointer points to the trampoline, and executing the trampoline. The system for instrumentation may include a breakpoint setup module and a breakpoint execution module for respectively setting up and completing instrumentation involving the trampoline.

Dynamic instrumentation

Methods, apparatuses, and computer program products for preserving, from resource management adjustment, portions of an overcommitted resource managed by a hypervisor are provided. Embodiments include identifying, by the hypervisor, a privileged guest from among a plurality of guests of the hypervisor; identifying, by the hypervisor, portions of the overcommitted resource that are allocated to the privileged guest; and preventing, by the hypervisor, resource management adjustment to the identified portions of the overcommitted resource that are allocated to the privileged guest.

Preserving, from resource management adjustment, portions of an overcommitted resource managed by a hypervisor

A system and method in one embodiment includes modules for detecting an access request by an application to access information in a mobile device, determining that the application is a potential threat according to at least one policy filter, and blocking a send request by the application to send the information from the mobile device without a user's consent. More specific embodiments include user selecting the information through a selection menu on a graphical user interface that includes information categories pre-populated by an operating system of the mobile device, and keywords that can be input by the user. Other embodiments include queuing the send request in a queue with other requests, and presenting an outbox comprising the queue to the user to choose to consent to the requests. The outbox includes graphical elements configured to permit the user to selectively consent to any requests in the queue.

System and method for profile based filtering of outgoing information in a mobile environment

A computer-implemented method is provided for reducing network traffic associated with live migration. The method comprises selecting a virtual machine on a first physical host for migration to a second physical host, and providing each application running in the selected virtual machine with notification that the migration has started. In response to receiving the notification that the migration has started, each application reducing the number of memory pages in use during the migration. The selected virtual machine and each application is then migrated from the first physical host to the second physical host, wherein the migration of each application includes migration of the reduced number of memory pages. Non-limiting examples of methods that may be used to reduce the number of memory pages includes identifying memory that contains garbage, reducing the size of the heap, increasing the pause time used for garbage collection, deferring just-in-time compilation of hot methods, and releasing caches and buffers.

Growing community of inventors

Gurgaon, India

Balbir Singh