METHOD AND APPARATUS FOR MONITORING A COMPUTER TO DETECT OPERATING SYSTEM PROCESS MANIPULATION

Patent №

US 8,214,900

Granted

2012-07-03

Filed 2008

Owner

SYMANTEC CORPORATION

Lab

—

AI components

hardware

Assignment

Recorded

Dataset

AIPD

2023_r1 edition

Application

12338587

A method and apparatus for monitoring a computer to detect operating system process manipulation by malicious software programs is disclosed. In one embodiment, a method for detecting operating system process manipulation through unexpected process behavior includes accessing process behavior indicia regarding memory addresses used by at least one user mode process to request computer resources and comparing the process behavior indicia with a user mode request to identify operating system process manipulation.

AI hardwareG06F 21/554G06F 21/566

Google Patents

AI classification

AI hardware0.54

Planning0.32

Machine learning0.06

Natural language0.01

Knowledge representation0.00

Speech0.00

Evolutionary computation0.00

Vision0.00

Ownership

SYMANTEC CORPORATION

assignment · 220080614

Assignors

SATISH, SOURABH, SOBEL, WILLIAM, MCCORKENDALE, BRUCE

On an employer assignment, the assignors are typically the inventors.

From the same owner

USING PHYSIOLOGICAL CUES TO MEASURE DATA SENSITIVITY AND IMPLEMENT SECURITY ON A USER DEVICEUS 11,775,673 · 2023 SECURE ACCESS TO A CORPORATE WEB APPLICATION WITH TRANSLATION BETWEEN AN INTERNAL ADDRESS AND AN EXTERNAL ADDRESSUS 11,665,171 · 2023 Multi-Second Factor AuthenticationUS 11,558,365 · 2023 SECURING CLOUD APPLICATIONS VIA ISOLATIONUS 11,558,383 · 2023 MACHINE LEARNING ADVERSARIAL CAMPAIGN MITIGATION ON A COMPUTING DEVICEUS 11,551,137 · 2023 KNOWLEDGE-AWARE DETECTION OF ATTACKS ON A CLIENT DEVICE CONDUCTED WITH DUAL-USE TOOLSUS 11,496,489 · 2022 SYSTEMS AND METHODS FOR IDENTIFYING AND MITIGATING PHISHING ATTACKSUS 11,496,511 · 2022 SYSTEMS AND METHODS FOR PRODUCING ADJUSTMENTS TO MALWARE-DETECTING SERVICESUS 11,461,462 · 2022

Cited by (28)

MITIGATION OF RETURN-ORIENTED PROGRAMMING ATTACKSUS 11,853,414 · 2023 IDENTIFICATION OF MALICIOUS EXECUTION OF A PROCESSUS 11,328,063 · 2022 MITIGATION OF RETURN-ORIENTED PROGRAMMING ATTACKSUS 11,194,900 · 2021 SECURITY IN A COMPUTING ENVIRONMENT BY MONITORING EXPECTED OPERATION OF PROCESSES WITHIN THE COMPUTING ENVIRONMENTUS 11,182,472 · 2021 MITIGATION OF RETURN-ORIENTED PROGRAMMING ATTACKSUS 10,650,141 · 2020 IDENTIFICATION OF MALICIOUS EXECUTION OF A PROCESSUS 10,467,409 · 2019 CONTINUOUS MALICIOUS SOFTWARE IDENTIFICATION THROUGH RESPONSIVE MACHINE LEARNINGUS 10,460,104 · 2019 User-Mode Component Injection TechniquesUS 10,331,881 · 2019 Method and Apparatus for Hypervisor Based Monitoring of System InteractionsUS 10,198,280 · 2019 CODE SNIPPET CONTENT RECOMMENDATION TO DEFINE AN OBJECT LITERALUS 10,162,605 · 2018 Continuous Malicious Software Identification Through Responsive Machine LearningUS 10,078,752 · 2018 CONFIGURATION MANAGEMENT FOR A RESOURCE WITH PREREQUISITESUS 10,069,685 · 2018 HARDWARE AND SOFTWARE EXECUTION PROFILINGUS 10,055,585 · 2018 MALICIOUS SOFTWARE IDENTIFICATION INTEGRATING BEHAVIORAL ANALYTICS AND HARDWARE EVENTSUS 9,977,895 · 2018 Systems And Methods For Dynamically Protecting A Stack From Below The Operating SystemUS 9,703,726 · 2017 CONFIGURATION MANAGEMENT FOR A RESOURCE WITH PREREQUISITESUS 9,674,109 · 2017 DETECTING RETURN-ORIENTED PROGRAMMING PAYLOADS BY EVALUATING DATA FOR A GADGET ADDRESS SPACE ADDRESS AND DETERMINING WHETHER OPERATIONS ASSOCIATED WITH INSTRUCTIONS BEGINNING AT THE ADDRESS INDICATE A RETURN-ORIENTED PROGRAMMING PAYLOADUS 9,495,541 · 2016 SYSTEMS AND METHODS FOR INHIBITING ATTACKS ON APPLICATIONSUS 8,763,103 · 2014 METHODS, MEDIA, AND SYSTEMS FOR DETECTING ANOMALOUS PROGRAM EXECUTIONSUS 8,601,322 · 2013 SYSTEMS, METHODS, AND MEDIA PROTECTING A DIGITAL DATA PROCESSING DEVICE FROM ATTACKUS 8,407,785 · 2013 Patent US 10,192,049US 10,192,049 Patent US 10,305,919US 10,305,919 Patent US 10,496,812US 10,496,812 Patent US 11,599,628US 11,599,628 Patent US 9,143,518US 9,143,518

and 3 more

Related research

An Improved Process Supervision and Control Method for Malware DetectionSemantic Scholar Process Monitoring System Based on Anomaly Detection Statistics AlgorithmSemantic Scholar Machine Learning and Recognition of User Tasks for Malware DetectionSemantic Scholar A Planning Approach to Monitoring Behavior of Computer ProgramsarXiv Natural Language Processing based Anomalous System Call Sequences Detection with Virtual Memory IntrospectionSemantic Scholar

Full text

Google Patents