System and method for indirect interface monitoring and plumb-lining

• US 8,707,434 B2
• Filed: 08/17/2011
• Issued: 04/22/2014
• Est. Priority Date: 08/17/2011
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Dalcher, Gregory W.
• Primary Examiner(s): Patel, Nirav B
• Assistant Examiner(s): Waliullah, Mohammed
• Application Number:
  US13/211,999
• Publication Number:
  US 20130047255A1
• Time in Patent Office: 979 Days
• Field of Search: None
• US Class Current: 726/23
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method is provided in one example embodiment that includes monitoring a first interface, monitoring a second interface, and taking a policy action if the second interface is not executed before the first interface. In more particular embodiments, monitoring the second interface may include walking a call stack associated with the first interface. Moreover, a program context for calling code associated with the second interface may be identified and acted upon.

Claims

1. A method, comprising:

monitoring, by a processor, a first interface by directly monitoring the first interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack;

monitoring, by the processor, a second interface by;

identifying, based on a callback, a calling code associated with the second interface by unwinding one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed to the stack; and

identifying a program context associated with the calling code; and

taking a policy action if the second interface is not executed before the first interface.

2. The method of claim 1, wherein monitoring the second interface comprises indirectly monitoring the second interface.

3. The method of claim 1, wherein monitoring the second interface comprises walking a call stack associated with the first interface.

4. The method of claim 1, further comprising:

determining if the calling code is legitimate; and

taking the policy action if the calling code is not legitimate.

5. The method of claim 1, wherein monitoring the first interface comprises:

storing data associating an execution element with the first interface.

6. The method of claim 1, wherein:

the first interface is a kernel-mode interface; and

monitoring the second interface comprises walking a call stack associated with the kernel-mode interface.

7. The method of claim 1, wherein:

monitoring the first interface comprises receiving a callback on execution of the first interface and storing data associating an execution element with the execution of the first interface.

8. The method of claim 1, further comprising tracking an execution element associated with the first interface and wherein the policy action is taken if the second interface is not executed by the execution element.

9. The method of claim 8, wherein the tracking includes storing an identifier of the execution element and a time of execution associated with the execution element.

10. The method of claim 8, wherein the execution element is at least one of:

a thread; and

a fiber.

11. The method of claim 1, wherein the call frame further includes one or more local variables for the calling code.

12. One or more non-transitory tangible media encoding logic that include instructions for execution that, when executed by a processor, is operable to perform operations comprising:

monitoring, by a processor, a first interface by directly monitoring the first interface, wherein the first interface is associated with a call stack of call frames pushed onto the call stack;

monitoring, by the processor, a second interface by;

identifying, based on a callback, a calling code associated with the second interface from one of the call frames of the call stack associated with the first interface, wherein the call frame includes a pointer to the calling code and one or more parameters passed to the calling code and wherein the calling code caused the call frame to be pushed onto the stack;

identifying a function within the calling code to determine security of the function; and

taking a policy action if the second interface is not executed before the first interface.

13. The media of claim 12, wherein the operations further comprise:

tracking an execution element associated with the first interface and wherein the policy action is taken if the second interface is not executed by the execution element.

14. The media of claim 13, wherein the tracking includes storing an identifier of the execution element and a time of execution associated with the execution element.

15. The media of claim 12, wherein identifying the calling code includes:

unwinding the call frame to access each entry of the call frame;

determining whether an entry points to valid memory within a process address space; and

if the entry points to valid memory, determining whether the entry is the pointer that points to the calling code and not data within the memory.

16. The media of claim 12, wherein the operations further comprise:

determining a type of memory pointed to by the pointer.

17. The media of claim 16, wherein the type of memory is at least one of:

memory backed by a loaded executable application file;

memory not backed by a loaded executable application file; and

memory containing interpreted code.