DETECTION OF CODE INJECTION ATTACKS

• US 20150067409A1
• Filed: 09/04/2013
• Published: 03/05/2015
• Est. Priority Date: 09/04/2013
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Francisco Partners Management LLC)
• Original Assignee: Raytheon BBN Technologies Corp. (Rtx Corporation)
• Inventors: Martz, Robert, Matthews, David, Edmison, Joshua, Vorsanger, Greg
• Granted Patent: US 9,213,807 B2
• Time in Patent Office: Days
• US Class Current: 714/47.2
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action

Abstract

A method for detecting foreign code injected into a computer system including a processor and memory, the processor being configured to execute instructions stored in the memory, includes: detecting, on the computer system, an illegal instruction error; recording the illegal instruction error; determining whether a threshold condition is met; and generating an alert if the threshold condition is met.

Claims

1. A method for detecting foreign code injected into a computer system comprising a processor and memory, the processor being configured to execute instructions stored in the memory, the method comprising:

detecting, on the computer system, an illegal instruction error;

recording the illegal instruction error;

determining whether a threshold condition is met; and

generating an alert if the threshold condition is met.

2. The method of claim 1, wherein the threshold condition comprises exceeding a particular number of illegal instruction errors over a particular time period.

3. The method of claim 1, wherein determining whether the threshold condition is met comprises detecting a pattern using a neural network.

4. The method of claim 1, wherein the threshold condition comprises detecting a pattern using a Bayesian network.

5. The method of claim 1, wherein the processor is configured to execute instructions encoded in a first instruction set and

wherein the illegal instruction error is triggered by an instruction encoded in a second instruction set different from the first instruction set.

6. The method of claim 5, further comprising:

loading an instruction stream, the instruction stream being encoded in the first instruction set,

wherein the first instruction set is different from a native instruction set of the processor.

7. The method of claim 5, further comprising:

loading a plurality of instruction streams, each of the plurality of instruction streams being equivalent and being encoded in a different instruction set of a plurality of instruction sets;

executing, in a context, a first stream of the plurality of instruction streams;

stopping execution of the first stream at a first location of the first stream; and

executing, in the context, a second stream of the plurality of instruction streams at a second location of the second stream, the second location corresponding to the first location of the first stream,

wherein the first stream and the second stream are encoded in instruction sets different from the second instruction set.

8. The method of claim 1, wherein generating the alert comprises sending an email message or a text message.

9. The method of claim 1, further comprising shutting down the computer system when the threshold condition is met.

10. A computer system comprising a processor and memory storing program instructions, the computer system being configured to execute instructions stored in the memory, the computer system being configured to:

detect an illegal instruction error;

record the illegal instruction error;

determine whether a threshold condition is met; and

generate an alert if the threshold condition is met.

11. The computer system of claim 10, wherein the threshold condition comprises exceeding a particular number of illegal instruction errors over a particular time period.

12. The computer system of claim 10, wherein the computer system is configured to determine whether the threshold condition is met by detecting a pattern using a neural network.

13. The computer system of claim 10, wherein the computer system is configured to determine whether the threshold condition is met by detecting a pattern using a Bayesian network.

14. The computer system of claim 10, wherein the computer system is further configured to execute instructions encoded in a first instruction set and

wherein the illegal instruction error is triggered by an instruction encoded in a second instruction set different from the first instruction set.

15. The computer system of claim 14, wherein the computer system is further configured to load an instruction stream, the instruction stream being encoded in the first instruction set,

wherein the first instruction set is different from a native instruction set of the processor.

16. The computer system of claim 14, wherein the computer system is further configured to:

load a plurality of instruction streams, each of the plurality of instruction streams being equivalent and being encoded in a different instruction set of a plurality of instruction sets;

execute, in a context, a first stream of the plurality of instruction streams;

stop execution of the first stream at a first location of the first stream; and

execute, in the context, a second stream of the plurality of instruction streams at a second location of the second stream, the second location corresponding to the first location of the first stream,

wherein the first stream and the second stream are encoded in instruction sets different from the second instruction set.

17. The computer system of claim 10, wherein the computer system is configured to generate the alert by sending an email message or a text message.

18. The computer system of claim 10, wherein the computer system is further configured to shut down the computer system when the threshold condition is met.

19. A non-transitory computer readable medium embodying program instructions for execution by a data processing apparatus, the program instructions adapting the processing apparatus for:

detecting, on the data processing apparatus, an illegal instruction error;

recording the illegal instruction error;

determining whether a threshold condition is met; and

generating an alert if the threshold condition is met.

20. The non-transitory computer readable medium of claim 19, wherein the program instructions further adapt the processing apparatus for:

loading a plurality of instruction streams, each of the plurality of instruction streams being equivalent and being encoded in a different instruction set of a plurality of instruction sets;

executing, in a context, a first stream of the plurality of instruction streams;

stopping execution of the first stream at a first location of the first stream; and

executing, in the context, a second stream of the plurality of instruction streams at a second location of the second stream, the second location corresponding to the first location of the first stream,

wherein the illegal instruction error is triggered by a program instruction encoded in a first instruction set, the first instruction set being different from the instruction sets of the first stream and the second stream.