System, Method, and Computer Program Product for Monitoring and/or Analyzing At Least One Aspect of An Invocation of An Interface

• US 20160026794A1
• Filed: 05/01/2015
• Published: 01/28/2016
• Est. Priority Date: 01/24/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory William
• Granted Patent: US 9,824,215 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 11/302 where the computing system component is a software system
• CPC Class Codes: G06F 11/3051 Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs verification or detection of system hardware configuration G06F11/2247
• CPC Class Codes: G06F 11/3089 Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 2221/033 Test or assess software

Abstract

A system, method and computer program product are provided. In use, execution of a portion of internal code of an interface is identified. Further, in response to the execution of the portion of internal code, at least one aspect of an invocation of the interface is monitored and/or analyzed.

Claims

1. A method, comprising:

identifying execution of an interface, including identifying that a code segment internal to the interface has been executed;

in response to the execution of the interface, determining whether the interface was executed as a result of executing a defined entry point of the interface; and

determining whether the execution is malicious based upon whether the entry point was invoked prior to execution of the code segment;

wherein the entry point is located logically before the code segment.

4. The method as recited in claim 1, further comprising predetermining that the code segment is to be monitored for execution with respect to the entry point.

5. The method as recited in claim 1, wherein the code segment is determined during runtime by:

determining a starting address of the interface; and

determining a size of the interface.

6. The method as recited in claim 1, and further comprising determining whether the execution is malicious further based upon whether the interface includes a single entry point.

10. The method as recited in claim 1, further comprising determining whether the execution of the code segment is malicious based upon a determination that the entry point of the interface was not invoked.

18. The method as recited in claim 1, further comprising:

identifying that a code segment internal to the interface has been executed by utilizing a callback function; and

verifying the callback function by determining whether a memory address associated with the callback function is located within code of the interface.

2. (canceled)

3. (canceled)

7-10. -10. (canceled)

11-17. -17. (canceled)

19. A computer program product embodied on a non-transitory computer readable medium, comprising instructions that, when loaded and executed by a processor, cause the processor to:

identify execution of an interface, including identifying that a code segment internal to the interface has been executed; and

determine whether the execution is malicious based upon whether the entry point was invoked prior to execution of the code segment;

wherein the entry point is located logically before the code segment.

22. The computer program product of claim 19, further comprising instructions for causing the processor to predetermine that the code segment is to be monitored for execution with respect to the entry point.

23. The computer program product of claim 19, further comprising instructions for causing the processor to determine the code segment to be monitored during runtime by:

determining a starting address of the interface; and

determining a size of the interface

24. The computer program product of claim 19, further comprising instructions for causing the processor to determine whether the execution is malicious further based upon whether the interface includes a single entry point.

25. The computer program product of claim 19, further comprising instructions for causing the processor to determine whether the execution is malicious based upon a determination that the entry point of the interface was not invoked.

26. The computer program product of claim 19, further comprising instructions for causing the processor to:

identify that another portion of internal code of the interface was invoked; and

determine that the execution is malicious based at least upon an identification that the other portion of internal code was invoked prior to execution of the code segment;

wherein the code segment is located logically before the other portion of internal code.

27. The computer program product of claim 19, further comprising instructions for causing the processor to:

identify that a code segment internal to the interface has been executed by utilizing a callback function; and

verify the callback function by determining whether a memory address associated with the callback function is located within code of the interface.

20. A system, comprising:

a processor;

detection logic executable by the processor to identify execution of an interface, including identifying that a code segment internal to the interface has been executed; and

analysis logic executable by the processor to determine whether the execution is malicious based upon whether the entry point was invoked prior to execution of the code segment;

wherein the entry point is located logically before the code segment.

28. The system of claim 20, wherein the detection logic is further executable by the processor to configure the system to predetermine that the code segment is to be monitored for execution with respect to the entry point.

29. The system of claim 20, wherein the detection logic is further executable by the processor to determine the code segment to be monitored during runtime by:

determining a starting address of the interface; and

determining a size of the interface

30. The system of claim 20, wherein the analysis logic is further executable by the processor to determine whether the execution is malicious further based upon whether the interface includes a single entry point.

31. The system of claim 20, wherein the analysis logic is further executable by the processor to determine whether the execution is malicious based upon a determination that the entry point of the interface was not invoked.

32. The system of claim 20, wherein:

the detection logic is further executable to identify that another portion of internal code of the interface was invoked; and

the analysis logic is further executable to determine that the execution is malicious based at least upon an identification that the other portion of internal code was invoked prior to execution of the code segment;

wherein the code segment is located logically before the other portion of internal code.

33. The system of claim 20, wherein the analysis logic is further executable by the processor to:

identify that a code segment internal to the interface has been executed by utilizing a callback function; and

verify the callback function by determining whether a memory address associated with the callback function is located within code of the interface.

21. (canceled)