HARDWARE AND SOFTWARE EXECUTION PROFILING

• US 20150067763A1
• Filed: 08/28/2013
• Published: 03/05/2015
• Est. Priority Date: 08/28/2013
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Dalcher, Gregory William, Sahita, Ravi L., Yamada, Koichi, Krishnaswamy, Arvind, Shanmugavelayutham, Palanivelra
• Granted Patent: US 10,055,585 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Abstract

Technologies for assembling an execution profile of an event are disclosed. The technologies may include monitoring the event for a branch instruction, generating a callback to a security module upon execution of the branch instruction, filtering the callback according to a plurality of event identifiers, and validating a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction.

Claims

1-22. -22. (canceled)

23. A method for assembling an execution profile of an event, the method comprising:

monitoring the event for a branch instruction;

generating a callback to a security module upon execution of the branch instruction;

filtering the callback according to a plurality of event identifiers; and

validating a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction.

24. The method of claim 23, further comprising checking the code segment for use of return-oriented programming techniques.

25. The method of claim 23, further comprising managing security policies for the system.

26. The method of claim 23, further comprising monitoring the event for the branch instruction using binary translation-based techniques.

27. The method of claim 23, further comprising providing an event trigger from a monitoring extension to the processor, the event trigger for use in monitoring the event for the branch instruction.

28. The method of claim 23, further comprising providing an event trigger from a monitoring extension to the processor, the event trigger for use in monitoring the event for the branch instruction, wherein the event trigger comprises a trigger when an instruction of a particular type is executed.

29. The method of claim 23, further comprising providing an event trigger from a monitoring extension to the processor, the event trigger for use in monitoring the event for the branch instruction, wherein the event trigger comprises a trigger invoking a registered callback for handling of the event.

30. A system for securing an electronic device, comprising:

a memory;

a processor;

a secured system resource; and

one or more security agents including instructions resident in the memory and operable for execution by the processor, wherein the security agents are configured to;

assemble an execution profile of an event;

monitor the event for a branch instruction;

generate a callback to upon execution of the branch instruction;

filter the callback according to a plurality of event identifiers; and

validate a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction.

31. The system of claim 30, wherein the security agents are further configured to check the code segment for use of return-oriented programming techniques.

32. The system of claim 30, wherein the security agents are further configured to access managing security policies for the system to assemble the execution profile.

33. The system of claim 30, wherein the security agents are further configured to monitor the event for the branch instruction using binary translation-based techniques.

34. The system of claim 30, wherein the security agents are further configured to access an event trigger from a monitoring extension of a processor to monitor the event for a branch instruction.

35. The system of claim 30, wherein the security agents are further configured to access an event trigger from a monitoring extension of a processor to monitor the event for a branch instruction, the event trigger based upon an instruction of a particular type is executed.

36. The system of claim 30, wherein the security agents are further configured to access an event trigger from a monitoring extension of a processor to monitor the event for a branch instruction, the event trigger invoking a registered callback for handling of the event.

37. At least one machine readable storage medium, comprising computer-executable instructions carried on the computer readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:

assemble an execution profile of an event;

monitor the event for a branch instruction;

generate a callback to upon execution of the branch instruction;

filter the callback according to a plurality of event identifiers; and

validate a code segment associated with the branch instruction, the code segment including code executed before the branch instruction and code executed after the branch instruction.

38. The medium of claim 37, wherein the processor is further configured to check the code segment for use of return-oriented programming techniques.

39. The medium of claim 37, wherein the processor is further configured to monitor the event for the branch instruction using binary translation-based techniques.

40. The medium of claim 37, wherein the processor is further configured to access an event trigger from a monitoring extension of a processor to monitor the event for a branch instruction.

41. The medium of claim 37, wherein the processor is further configured to access an event trigger from a monitoring extension of a processor to monitor the event for a branch instruction, the event trigger based upon an instruction of a particular type is executed.

42. The medium of claim 37, wherein the processor is further configured to access an event trigger from a monitoring extension of a processor to monitor the event for a branch instruction, the event trigger invoking a registered callback for handling of the event.