Emc IP Holding Company LLC

Etienne Boucher

Martin Rosa

Scott Moore

Edward G Quackenbush

Matthew D Tharp

Scott G Carter

A method comprises detecting a plurality of floating code instances associated with one or more endpoint devices of a computer network, obtaining metadata of each of the floating code instances, and generating floating code signatures for respective ones of the floating code instances based at least in part on their respective metadata. The floating code signatures are utilized to categorize one or more of the floating code instances as at least potentially malicious floating code instances. A given one of the floating code instances illustratively comprises an executable code block dynamically allocated in a memory of a corresponding one of the endpoint devices and does not include any file structure counterpart. The metadata utilized to generate the floating code signature of a given one of the floating code instances illustratively comprises at least one of image hook metadata and thread metadata of the given floating code instance.

Metadata-based floating code signature generation for endpoint devices of a computer network

An apparatus in one embodiment comprises a first endpoint device having a processor coupled to a memory. The first endpoint device is adapted for communication with other endpoint devices over a network, and implements a key capture agent configured to interface with an operating system of the first endpoint device. The key capture agent is configured to collect key material associated with a session key utilized to encrypt packets sent by the first endpoint device to a second endpoint device over the network as part of a corresponding session. The key material and an identifier of the corresponding session are transmitted for delivery to a decoder that is not part of the first or second endpoint devices, so as to permit the decoder to be configured to decrypt the encrypted packets in intercepted network traffic. For example, the key capture agent may be configured to transmit the key material.

Growing community of inventors

Pierrefonds, Canada

Etienne Boucher