Mcafee, Inc.

Oleksandr Bazhaniuk

Yuriy Bulygin

Igor G Muttik

Alex Nayshtut

Andrew A Furtak

Koichi Yamada

Vadim Sukhomlinov

Carl D Woodward

Dmitri Rubakha

Palanivelrajan Rajan Shanmugavelayutham

Jennifer Eligius Mankin

Sevin F Varoglu

Dima Mirkin

Ravi L Sahita

Gideon Gerzon

Ofer Levy

Hisham Shafi

Sameer Desai

Mikhail V Gorobets

Methods, apparatus, systems, and articles of manufacture are disclosed for dynamic re-distribution of detection content and algorithms for exploit detection. An example apparatus includes at least one processor, and memory including instructions that, when executed, cause the at least one processor to deploy respective ones of a plurality of standard detection algorithms and content (SDACs) to respective ones of a first endpoint and a second endpoint, deploy a first set of enhanced detection algorithms and content (EDACs) to the first endpoint, deploy a second set of the EDACs to the second endpoint, the second set of EDACs different from the first set of EDACs, and in response to obtaining a notification indicative of an exploit attack from the first endpoint, distribute the first set of EDACs to the second endpoint to facilitate detection of the exploit attack at the second endpoint.

Dynamic re-distribution of detection content and algorithms for exploit detection

A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection

In an embodiment, a processor for Return Oriented Programming (ROP) detection includes at least one execution unit; a plurality of event counters, each event counter associated with a unique type of a plurality of types of control transfer events; and a ROP detection unit. The ROP detection unit may be to: adjust a first event counter in response to detection of a first type of control transfer events; in response to a determination that the first event counter exceeds a first threshold, access a first configuration register associated with the first event counter to read configuration data; identify a set of ROP heuristic checks based on the configuration data read from the first configuration register; and perform each ROP heuristic check of the identified set of ROP heuristic checks. Other embodiments are described and claimed.

Detection of return oriented programming attacks in a processor

A predetermined standard set of detection algorithms and content and a selected set of enhanced detection algorithms and content provide an improved technique for detecting security exploits. The detection algorithms and content are executed on a Platform Exploit Detection Module. Standard detection algorithms and content are deployed across all endpoints. Enhanced detection algorithms and content are selected from an available set of enhanced detection algorithms and content to improve detection capability without the performance impacts of deploying every enhanced detection algorithm and content on every endpoint. A network of endpoints may deploy an entire set of detection algorithms and content across all endpoints, with individual endpoints configured to with different subsets of the enhanced detection algorithms and content.

Growing community of inventors

Hillsboro, OR, United States of America

Oleksandr Bazhaniuk