Mcafee, Inc.

Intel Corporation

Sevin F Varoglu

Alex Nayshtut

Koichi Yamada

Igor G Muttik

Vadim Sukhomlinov

Carl D Woodward

Yuriy Bulygin

Dmitri Rubakha

Palanivelrajan Rajan Shanmugavelayutham

Jennifer Eligius Mankin

Oleksandr Bazhaniuk

Dima Mirkin

Ajay Harikumar

A combination of hardware monitoring and binary translation software allow detection of return-oriented programming (ROP) exploits with low overhead and low false positive rates. Embodiments may use various forms of hardware to detect ROP exploits and indicate the presence of an anomaly to a device driver, which may collect data and pass the indication of the anomaly to the binary translation software to instrument the application code and determine whether an ROP exploit has been detected. Upon detection of the ROP exploit, the binary translation software may indicate the ROP exploit to an anti-malware software, which may take further remedial action as desired.

Hardware heuristic-driven binary translation-based execution analysis for return-oriented programming malware detection

After a heuristic event counter in a processor has triggered a performance monitoring interrupt (PMI) when the processor was executing a target program in user mode, and after the processor has switched to kernel mode in response to the PMI, a heuristic event handler automatically performs preliminary analysis in kernel mode, without switching back to user mode, to determine whether heavyweight code analysis is warranted. The preliminary analysis comprises (a) obtaining an instruction pointer (IP) for the target program from a last branch record (LBR) buffer in the processor, (b) using transaction hardware in the processor to determine whether the IP from LBR buffer points to a readable page in memory, and (c) determining that heavyweight code analysis is not warranted in response to a determination that the page pointed to by the IP from LBR buffer is not readable. Other embodiments are described and claimed.

Systems, methods, and apparatus for detecting control flow attacks

Growing community of inventors

Santa Clara, CA, United States of America

Sevin F Varoglu