Mcafee, Inc.

Jennifer Eligius Mankin

Carl D Woodward

Vadim Sukhomlinov

Dmitri Rubakha

Igor G Muttik

Alex Nayshtut

Koichi Yamada

Simon R Hunt

Yuriy Bulygin

Palanivelrajan Rajan Shanmugavelayutham

Oleksandr Bazhaniuk

Sevin F Varoglu

Dima Mirkin

Howard C Herbert

Katalin Klara Bartfai-Walcott

Rameshkumar G Illikkal

Venkata Ramanan Sambandam

Jeremy F Bennett

Mark E Scott-Nash

Palanivel Rajan Shanmugavelayutham

Jeffrey Zimmerman

A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection

In an example, there is disclosed a computing apparatus, having a computing resource; a bespoke sensor for measuring at least one parameter of usage of the computing resource; and one or more logic elements providing a trusted compute meter (TCM) agent to: receive an external workload; provision a workload enclave; execute the external workload within the TCM enclave; and measure resource usage of the external workload via the bespoke sensor. There is also disclosed a computer-readable medium having stored thereon executable instructions for providing a TCM agent, and a method of providing a TCM agent.

Trusted computing resource meter

Providing synchronous processing of the designated computing events using hardware-assisted virtualization technology by performing at least the following: detecting a designated computing event using a high priority, low capability routine, creating a copy code in an alternate memory space of a first code located in a first memory space, modifying the copy code to call for analysis of at least a portion of the copy code that corresponds to the first code, switching execution of the first code with the modified copy code using an address translation data structure that translates a guest memory address to a host memory address after a return of the high priority, low capability routine; and analyzing synchronously the at least a portion of the code within the copy code that corresponds to the first code based on the replacement of the first code with the modified copy code.

Synchronous execution of designated computing events using hardware-assisted virtualization

There is disclosed in one example, a computing apparatus, including: first one or more logic elements providing a code module, the code module comprising a member having a branching policy designating either a public or private member; second one or more logic elements providing a policy engine, operable to: receive a first branch instruction to the member; determine that the branch instructions does not meet the policy; and take a security action. There is also disclosed a method of providing a policy engine, and a computer-readable medium having stored thereon executable instructions for providing a policy engine.

Hardware-enforced code paths

In an example, a cross-view detection engine is disclosed for detecting malware behavior. Malware may attempt to avoid detection by remaining in volatile memory for as long as possible, and writing to disk only when necessary. To avoid detection, the malware may also provide a pseudo-driver at a file system level that performs legitimate-looking dummy operations. A firmware-level driver may simultaneously perform malicious operations. The cross-view detection engine detects this behavior by deconstructing call traces from the file system-level operations, and reconstructing call traces from firmware-level operations. If the traces do not match, the object may be flagged as suspicious.

Cross-view malware detection

Growing community of inventors

San Jose, CA, United States of America

Jennifer Eligius Mankin