×

System and method for sampling forensic data of unauthorized activities using executability states

  • US 8,789,189 B2
  • Filed: 06/17/2011
  • Issued: 07/22/2014
  • Est. Priority Date: 06/24/2010
  • Status: Active Grant
First Claim
Patent Images

1. A computer implemented method of identifying unauthorized activities on a computer system, said computer system comprising:

  • one or more processors; and

    memory segmented into multiple pages, said memory storing one or more programs for execution by the one or more processors, said method comprising;

    locating a list of target addresses;

    while executing at least one of the one or more programs;

    in response to detecting a request to execute an instruction located at a first address of a first page;

    locating a first page table entry corresponding to the first page, the first page table entry having a first executability state; and

    determining the first executability state;

    when the first executability state is non-executable,identifying a first set of one or more target addresses in the list of target addresses that correspond to the first page;

    identifying a second set of one or more target addresses in the list that correspond to one or more pages other than the first page;

    storing one or more target addresses of the first set of target addresses in breakpoint registers of the computer system, each breakpoint register configured to store an address of a respective breakpoint in the memory;

    setting the first executability state of the first page table entry as executable; and

    setting the executability states of page table entries that correspond to the second set of target addresses as non-executable; and

    when the first address corresponds to one of the target addresses stored in the breakpoint registers, recording forensic data associated with the request to execute the instruction located at the first address.

View all claims
  • 5 Assignments
Timeline View
Assignment View
    ×
    ×