University of North Carolina at Chapel Hill

The Johns Hopkins University

The State University of New York

Kevin Zachary Snow

Fabian Newman Monrose

Srinivas Krishnan

Nathan Otterness

Teryl Paul Taylor

Russell Andrew Fink

Robert John Dallara

Tommy O Johnson

Georgios Baltas

Shaun T Hutton

Jan Jakub Werner

Michalis Polychronakis

Methods, systems, and computer readable media for preventing code reuse attacks are disclosed. According to one method, the method includes executing, on a processor, code in a memory page related to an application, wherein the memory page is protected. The method also includes detecting a read request associated with the code. The method further includes after detecting the read request, modifying, without using a hypervisor, at least one memory permission associated with the memory page such that the code is no longer executable after the code is read.

Methods, systems, and computer readable media for preventing code reuse attacks

Methods, systems, and computer readable media for detecting malicious network traffic are disclosed. According to one method, the method includes caching network traffic transmitted between a client and a server, wherein the network traffic includes a uniform resource locator (URL) for accessing at least one file from the server. The method also includes determining whether the at least one file is suspicious. The method further includes in response to determining that the at least one file is suspicious, determining whether the at least one file is malicious by replaying the network traffic using an emulated client and an emulated server.

Methods, systems, and computer readable media for detecting malicious network traffic

According to one aspect, the subject matter described herein includes a method for efficient computer forensic analysis and data access control. The method includes steps occurring from within a virtualization layer separate from a guest operating system. The steps include monitoring disk accesses by the guest operating system to a region of interest on a disk from which data is copied into memory. The steps also include tracking subsequent accesses to the memory resident data where the memory resident data is copied from its initial location to other memory locations or over a network. The steps further include linking operations made by the guest operating system associated with the disk accesses with operations made by the guest operating system associated with the memory accessed.

Methods, systems, and computer readable media for efficient computer forensic analysis and data access control

According to one aspect, the subject matter described herein includes a method for detecting injected machine code. The method includes extracting data content from a buffer. The method also includes providing an operating system kernel configured to detect injected machine code. The method further includes executing, using the operating system kernel, the data content on a physical processor. The method further includes monitoring, using the operating system kernel, the execution of the data content to determine whether the data content contains injected machine code indicative of a code injection attack.

Methods, systems, and computer readable media for detecting injected machine code

A system and method for identifying and verifying a client to access a secure network. Timing characteristics are acquired from the client, such as a peripheral device, and further verified and identified via a policy enforcement points and a policy decision points, or a measurer device in the secure network.

Identification and verification of peripheral devices accessing a secure network

Growing community of inventors

Cary, NC, United States of America

Kevin Zachary Snow