System, method, and computer program product for detecting at least potentially unwanted activity based on execution profile monitoring

• US 8,613,084 B2
• Filed: 09/18/2007
• Issued: 12/17/2013
• Est. Priority Date: 09/18/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory William
• Primary Examiner(s): Hirl, Joseph P.
• Assistant Examiner(s): King, John B
• Application Number:
  US11/857,373
• Publication Number:
  US 20130276110A1
• Time in Patent Office: 2,282 Days
• Field of Search: 726 22- 25, 713/188
• US Class Current: 726/22
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system, method, and computer program product are provided for detecting at least potentially unwanted activity based on execution profile monitoring. In use, an execution profile of code is monitored utilizing call frame monitoring. Further, at least potentially unwanted activity is detected based on the monitoring of the execution profile.

Claims

1. A method of detecting at least potentially unwanted activity, comprising:

monitoring, with a processor, an execution profile of code by utilizing call frame monitoring;

noting, with the processor, a call frame associated with the code;

identifying, with the processor, executable memory associated with the noted call frame, wherein the executable memory is backed by a loaded executable;

identifying, with the processor, an owner of the executable memory by determining a file path of the loaded executable;

determining, with the processor, whether the owner of the executable memory is legitimate; and

identifying unwanted activity based on a determination that the owner of the executable memory is not legitimate.

2. The method of claim 1, wherein the code includes executable code.

3. The method of claim 1, wherein the code is associated with an event.

4. The method of claim 3, wherein the event includes invocation of a hooked interface.

5. The method of claim 3, wherein the event includes generation of an interrupt.

6. The method of claim 1, wherein the execution profile includes event handling associated with the code.

7. The method of claim 1, wherein the execution profile includes components executed by the code.

8. The method of claim 1, wherein the call frame monitoring includes monitoring call frames associated with the code that are added to an execution stack.

9. The method of claim 1, wherein the call frame monitoring includes monitoring call frames associated with the code that are removed from an execution stack.

10. The method of claim 1, further comprising holding an event associated with the code during initiation of the call frame monitoring.

11. The method of claim 1, wherein the at least potentially unwanted activity involves malware.

12. The method of claim 1, wherein the call frame is noted utilizing an inline hook.

13. The method of claim 1, wherein the call frame is noted utilizing virtualization.

14. The method of claim 1, wherein the loaded executable is an executable application file.

15. The method of claim 1, wherein the loaded executable is a loadable library.

16. A computer program product embodied on a non-transitory computer readable storage medium, comprising instructions stored thereon that when executed by one or more processors cause the one or more processors to:

monitor an execution profile of code by utilizing call frame monitoring;

note a call frame associated with the code;

identify executable memory associated with the noted call frame, wherein the executable memory is backed by a loaded executable;

identify an owner of the executable memory by determining a file path of the loaded executable;

determine whether the owner of executable memory associated with the noted call frame is legitimate; and

identify unwanted activity based on a determination that the owner of the executable memory is not legitimate.

17. A system, comprising:

a memory; and

a processor operatively coupled to the memory, the processor adapted to execute program code stored in the memory to;

monitor an execution profile of code by utilizing call frame monitoring,

detect at least potentially unwanted activity based on the monitoring of the execution profile, wherein detecting the at least potentially unwanted activity comprises;

noting a call frame associated with the code,

identifying executable memory associated with the noted call frame, wherein the executable memory is backed by a loaded executable,

identifying an owner of the executable memory by determining a file path of the loaded executable,

determining whether the owner of executable memory associated with the noted call frame is legitimate; and

identifying unwanted activity based on a determination that the owner of the executable memory is not legitimate.