System and method for indirect interface monitoring and plumb-lining

• US 9,237,171 B2
• Filed: 04/08/2014
• Issued: 01/12/2016
• Est. Priority Date: 08/17/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory W.
• Primary Examiner(s): Patel, Nirav B
• Assistant Examiner(s): Waliullah, Mohammed
• Application Number:
  US14/247,667
• Publication Number:
  US 20140223509A1
• Time in Patent Office: 644 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method is provided in one example embodiment that includes monitoring a first interface, monitoring a second interface, and taking a policy action if the second interface is not executed before the first interface. In more particular embodiments, monitoring the second interface may include walking a call stack associated with the first interface. Moreover, a program context for calling code associated with the second interface may be identified and acted upon.

Claims

1. One or more non-transitory tangible media encoding logic that include instructions for execution that, when executed by a processor, is operable to perform operations comprising:

monitoring a first interface and a second interface at a first level for one or more predetermined activities associated with the second interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack and wherein the monitoring includes directly monitoring the first interface and indirectly monitoring the second interface;

identifying a first predetermined activity based on a callback for a calling code associated with the second interface, wherein the calling code is contained within the call frame of the call stack associated with the first interface, wherein the identifying includes unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the call stack;

determining if a policy associated with the first predetermined activity indicates a second level of monitoring; and

adjusting the monitoring from the first level to a second level if indicated by the policy.

2. The media of claim 1, the operations further comprising:

repeating the monitoring, the identifying, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.

3. The media of claim 1, wherein adjusting the monitoring from the first level to the second level includes at least one of:

increasing the monitoring to the second level by adding particular predetermined activities to the monitoring; and

decreasing the monitoring to the second level by removing particular predetermined activities from the monitoring.

4. The media of claim 1, wherein adjusting the monitoring from the first level to the second level includes one of:

increasing the monitoring to the second level by adding monitoring for accesses that can be performed by the identified first predetermined activity; and

decreasing the monitoring to the second level by removing monitoring for accesses that can be performed by the identified first predetermined activity.

5. The media of claim 1, the operations further comprising:

scanning data associated with the first predetermined activity at a first level;

determining if the policy associated with the first predetermined activity indicates a second level of scanning; and

adjusting the scanning from the first level to the second level if indicated by the policy.

6. The media of claim 5, the operations further comprising:

repeating the scanning, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.

7. The media of claim 5, the operations further comprising:

determining if the data associated with the first predetermined activity includes unwanted data; and

performing one or more operations if the data includes unwanted data, wherein the one or more operations include at least one of;

blocking activity associated with the data, quarantining the data, reporting the unwanted data, and logging the unwanted data.

8. The media of claim 5, wherein adjusting the scanning from the first level to the second level if indicated by the policy includes at least one of:

increasing the scanning of a first subset of file operations for the first level to include a second set of file operations for the second level;

increasing the scanning of a first set of memory locations for the first level to include a second set of memory locations for the second level;

decreasing the scanning of a first subset of file operations for the first level to a reduced subset of file operations for the second level; and

decreasing the scanning of a first set of memory locations for the first level to a reduced subset of memory locations for the second level.

9. A system, comprising:

at least one memory element; and

at least one processor, the processor for performing operations associated with the system, including;

monitoring a first interface and a second interface at a first level for one or more predetermined activities associated with the second interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack and wherein the monitoring includes directly monitoring the first interface and indirectly monitoring the second interface;

identifying a first predetermined activity based on a callback for a calling code associated with the second interface, wherein the calling code is contained within the call frame of the call stack associated with the first interface, wherein the identifying includes unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the call stack;

determining if a policy associated with the first predetermined activity indicates a second level of monitoring; and

adjusting the monitoring from the first level to a second level if indicated by the policy.

10. The system of claim 9, the operations further comprising:

repeating the monitoring, the identifying, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.

11. The system of claim 9, wherein adjusting the monitoring from the first level to the second level includes at least one of:

increasing the monitoring to the second level by adding particular predetermined activities to the monitoring; and

decreasing the monitoring to the second level by removing particular predetermined activities from the monitoring.

12. The system of claim 9, wherein adjusting the monitoring from the first level to the second level includes one of:

increasing the monitoring to the second level by adding monitoring for accesses that can be performed by the identified first predetermined activity; and

decreasing the monitoring to the second level by removing monitoring for accesses that can be performed by the identified first predetermined activity.

13. The system of claim 9, the operations further comprising:

scanning data associated with the first predetermined activity at a first level;

determining if the policy associated with the first predetermined activity indicates a second level of scanning; and

adjusting the scanning from the first level to the second level if indicated by the policy.

14. The system of claim 13, the operations further comprising:

repeating the scanning, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.

15. The system of claim 13, the operations further comprising:

determining if the data associated with the first predetermined activity includes unwanted data; and

performing one or more operations if the data includes unwanted data, wherein the one or more operations include at least one of;

blocking activity associated with the data, quarantining the data, reporting the unwanted data, and logging the unwanted data.

16. The system of claim 13, wherein adjusting the scanning from the first level to the second level if indicated by the policy includes at least one of:

increasing the scanning of a first subset of file operations for the first level to include a second set of file operations for the second level;

increasing the scanning of a first set of memory locations for the first level to include a second set of memory locations for the second level;

decreasing the scanning of a first subset of file operations for the first level to a reduced subset of file operations for the second level; and

decreasing the scanning of a first set of memory locations for the first level to a reduced subset of memory locations for the second level.

17. A method, comprising:

monitoring a first interface and a second interface at a first level for one or more predetermined activities associated with the second interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack and wherein the monitoring includes directly monitoring the first interface and indirectly monitoring the second interface;

identifying a first predetermined activity based on a callback for a calling code associated with the second interface, wherein the calling code is contained within the call frame of the call stack associated with the first interface, wherein the identifying includes unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the call stack;

determining if a policy associated with the first predetermined activity indicates a second level of monitoring; and

adjusting the monitoring from the first level to a second level if indicated by the policy.

18. The method of claim 17, further comprising:

repeating the monitoring, the identifying, the determining and the adjusting for one or more other predetermined activities until the first predetermined activity is completed.

19. The method of claim 17, further comprising:

scanning data associated with the first predetermined activity at a first level;

determining if the policy associated with the first predetermined activity indicates a second level of scanning; and

adjusting the scanning from the first level to the second level if indicated by the policy.

20. The method of claim 19, further comprising:

determining if the data associated with the first predetermined activity includes unwanted data; and

performing one or more operations if the data includes unwanted data, wherein the one or more operations include at least one of;

blocking activity associated with the data, quarantining the data, reporting the unwanted data, and logging the unwanted data.