JP6837064B2 - ランタイム生成コードにおける悪意のあるコードの検出のためのシステムおよび方法 - Google Patents

ランタイム生成コードにおける悪意のあるコードの検出のためのシステムおよび方法 Download PDF

Info

Publication number
JP6837064B2
JP6837064B2 JP2018526555A JP2018526555A JP6837064B2 JP 6837064 B2 JP6837064 B2 JP 6837064B2 JP 2018526555 A JP2018526555 A JP 2018526555A JP 2018526555 A JP2018526555 A JP 2018526555A JP 6837064 B2 JP6837064 B2 JP 6837064B2
Authority
JP
Japan
Prior art keywords
code
runtime
generated code
memory
signature
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
JP2018526555A
Other languages
English (en)
Japanese (ja)
Other versions
JP2019502197A5 (enExample
JP2019502197A (ja
Inventor
ウディ ヤーヴォ
ウディ ヤーヴォ
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fortinet Inc
Original Assignee
Fortinet Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Fortinet Inc filed Critical Fortinet Inc
Publication of JP2019502197A publication Critical patent/JP2019502197A/ja
Publication of JP2019502197A5 publication Critical patent/JP2019502197A5/ja
Application granted granted Critical
Publication of JP6837064B2 publication Critical patent/JP6837064B2/ja
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Stored Programmes (AREA)
  • Debugging And Monitoring (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
JP2018526555A 2015-12-08 2016-09-07 ランタイム生成コードにおける悪意のあるコードの検出のためのシステムおよび方法 Active JP6837064B2 (ja)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US201562264404P 2015-12-08 2015-12-08
US62/264,404 2015-12-08
PCT/IL2016/050987 WO2017098495A1 (en) 2015-12-08 2016-09-07 Systems and methods for detection of malicious code in runtime generated code

Publications (3)

Publication Number Publication Date
JP2019502197A JP2019502197A (ja) 2019-01-24
JP2019502197A5 JP2019502197A5 (enExample) 2019-10-17
JP6837064B2 true JP6837064B2 (ja) 2021-03-03

Family

ID=57113519

Family Applications (1)

Application Number Title Priority Date Filing Date
JP2018526555A Active JP6837064B2 (ja) 2015-12-08 2016-09-07 ランタイム生成コードにおける悪意のあるコードの検出のためのシステムおよび方法

Country Status (8)

Country Link
US (1) US20170161498A1 (enExample)
EP (1) EP3387579A1 (enExample)
JP (1) JP6837064B2 (enExample)
CA (1) CA3005314A1 (enExample)
IL (1) IL259878B (enExample)
SG (1) SG11201804085SA (enExample)
TW (1) TWI791418B (enExample)
WO (1) WO2017098495A1 (enExample)

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9916448B1 (en) * 2016-01-21 2018-03-13 Trend Micro Incorporated Detection of malicious mobile apps
US10275595B2 (en) * 2016-09-29 2019-04-30 Trap Data Security Ltd. System and method for characterizing malware
TWI668592B (zh) * 2017-07-28 2019-08-11 中華電信股份有限公司 Method for automatically determining the malicious degree of Android App by using multiple dimensions
US10977368B1 (en) * 2017-12-27 2021-04-13 Ca Technologies, Inc. Detecting malware based on memory allocation patterns
US11238017B2 (en) * 2018-01-30 2022-02-01 Salesforce.Com, Inc. Runtime detector for data corruptions
US11609984B2 (en) * 2018-02-14 2023-03-21 Digital Guardian Llc Systems and methods for determining a likelihood of an existence of malware on an executable
US11481376B2 (en) 2018-06-19 2022-10-25 Salesforce, Inc. Platform for handling data corruptions
JP7672041B2 (ja) 2019-06-26 2025-05-07 久利寿 帝都 情報処理方法および情報処理システム
US11681804B2 (en) 2020-03-09 2023-06-20 Commvault Systems, Inc. System and method for automatic generation of malware detection traps
CN112199274B (zh) * 2020-09-18 2022-05-03 北京大学 基于V8引擎的JavaScript动态污点跟踪方法及电子装置
US11709675B2 (en) 2020-10-30 2023-07-25 Apple Inc. Software verification of dynamically generated code
CN112579094B (zh) * 2020-12-15 2024-05-14 上海赛可出行科技服务有限公司 一种基于模板代码匹配的轻量级热修复方法
CN113868655B (zh) * 2021-09-29 2025-07-11 北京天融信网络安全技术有限公司 木马查杀方法、装置、电子设备及计算机可读存储介质
US20230252162A1 (en) * 2022-02-10 2023-08-10 Cisco Technology, Inc. Application Vulnerability Score Based on Stack Traces
US12212585B2 (en) 2022-04-01 2025-01-28 Vectra Ai, Inc. Method, product, and system for analyzing a computer network to identify attack paths using a software representation that embodies network configuration and policy data for security management
US12219070B2 (en) 2022-04-01 2025-02-04 Vectra Ai, Inc. Method, product, and system for generating detection signatures based on attack paths in a computer network identified using a software representation that embodies network configuration and policy data for security management using detection signature templates
US12328322B2 (en) 2022-04-01 2025-06-10 Vectra Ai, Inc. Method, product, and system for network security management using software representation that embodies network configuration and policy data
EP4254866A1 (en) * 2022-04-01 2023-10-04 Vectra AI, Inc. Method, product, and system for generating detection signatures based on attack paths in a computer network identified using a software representation that embodies network configuration and policy data for security management using detection signature templates
US12477001B2 (en) 2022-04-01 2025-11-18 Vectra Ai, Inc. Method, product, and system for analyzing attack paths in computer network generated using a software representation that embodies network configuration and policy data for security management
US20240056481A1 (en) 2022-08-09 2024-02-15 Commvault Systems, Inc. Data storage management system integrating cyber threat deception

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070192863A1 (en) * 2005-07-01 2007-08-16 Harsh Kapoor Systems and methods for processing data flows
US7478431B1 (en) * 2002-08-02 2009-01-13 Symantec Corporation Heuristic detection of computer viruses
GB2396227B (en) * 2002-12-12 2006-02-08 Messagelabs Ltd Method of and system for heuristically detecting viruses in executable code
US7984304B1 (en) * 2004-03-02 2011-07-19 Vmware, Inc. Dynamic verification of validity of executable code
US8176554B1 (en) * 2008-05-30 2012-05-08 Symantec Corporation Malware detection through symbol whitelisting
US20110191848A1 (en) * 2010-02-03 2011-08-04 Microsoft Corporation Preventing malicious just-in-time spraying attacks
KR101122650B1 (ko) * 2010-04-28 2012-03-09 한국전자통신연구원 정상 프로세스에 위장 삽입된 악성코드 탐지 장치, 시스템 및 방법
US20120331303A1 (en) * 2011-06-23 2012-12-27 Andersson Jonathan E Method and system for preventing execution of malware
CN102819697B (zh) * 2011-12-26 2015-07-22 哈尔滨安天科技股份有限公司 一种基于线程反编译的多平台恶意代码检测方法和系统
TWI528216B (zh) * 2014-04-30 2016-04-01 財團法人資訊工業策進會 隨選檢測惡意程式之方法、電子裝置、及使用者介面

Also Published As

Publication number Publication date
US20170161498A1 (en) 2017-06-08
TW201721497A (zh) 2017-06-16
WO2017098495A1 (en) 2017-06-15
TWI791418B (zh) 2023-02-11
IL259878B (en) 2021-07-29
EP3387579A1 (en) 2018-10-17
CA3005314A1 (en) 2017-06-15
SG11201804085SA (en) 2018-06-28
JP2019502197A (ja) 2019-01-24
IL259878A (en) 2018-07-31

Similar Documents

Publication Publication Date Title
JP6837064B2 (ja) ランタイム生成コードにおける悪意のあるコードの検出のためのシステムおよび方法
Pappas et al. Transparent {ROP} exploit mitigation using indirect branch tracing
Zhang et al. Spectre: A dependable introspection framework via system management mode
RU2531861C1 (ru) Система и способ оценки вредоносности кода, исполняемого в адресном пространстве доверенного процесса
RU2691187C1 (ru) Система и способы аудита виртуальной машины
EP3123311B1 (en) Malicious code protection for computer systems based on process modification
EP2979219B1 (en) Suspicious program detection
JP6706273B2 (ja) インタープリタ仮想マシンを用いた挙動マルウェア検出
US10055585B2 (en) Hardware and software execution profiling
RU2632163C2 (ru) Общая распаковка приложений для обнаружения вредоносных программ
US10229268B2 (en) System and method for emulation-based detection of malicious code with unmet operating system or architecture dependencies
US20180089430A1 (en) Computer security profiling
US20090271867A1 (en) Virtual machine to detect malicious code
US10242190B2 (en) System and method for detection of malicious code by iterative emulation of microcode
CN109255235B (zh) 基于用户态沙箱的移动应用第三方库隔离方法
Bojinov et al. Address space randomization for mobile devices
EP3543883A1 (en) Detecting malware concealed by delay loops of software programs
Cloosters et al. Riscyrop: Automated return-oriented programming attacks on risc-v and arm64
Shioji et al. Code shredding: byte-granular randomization of program layout for detecting code-reuse attacks
Willems et al. Reverse code engineering—state of the art and countermeasures
Kleissner Stoned bootkit
Willems et al. Using memory management to detect and extract illegitimate code for malware analysis
JP2018152061A (ja) 安全なジャストインタイム（ｊｉｔ）コード生成
Bauman et al. Renewable Just-In-Time Control-Flow Integrity
US20250077198A1 (en) Exploit prevention based on generation of random chaotic execution context

Legal Events

Date Code Title Description
A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A821

Effective date: 20180723

RD01 Notification of change of attorney

Free format text: JAPANESE INTERMEDIATE CODE: A7426

Effective date: 20180720

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A523

Effective date: 20190906

A621 Written request for application examination

Free format text: JAPANESE INTERMEDIATE CODE: A621

Effective date: 20190906

RD02 Notification of acceptance of power of attorney

Free format text: JAPANESE INTERMEDIATE CODE: A7422

Effective date: 20191004

RD04 Notification of resignation of power of attorney

Free format text: JAPANESE INTERMEDIATE CODE: A7424

Effective date: 20191009

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A821

Effective date: 20191007

A711 Notification of change in applicant

Free format text: JAPANESE INTERMEDIATE CODE: A711

Effective date: 20200721

A977 Report on retrieval

Free format text: JAPANESE INTERMEDIATE CODE: A971007

Effective date: 20200916

A131 Notification of reasons for refusal

Free format text: JAPANESE INTERMEDIATE CODE: A131

Effective date: 20201006

A521 Request for written amendment filed

Free format text: JAPANESE INTERMEDIATE CODE: A523

Effective date: 20201225

TRDD Decision of grant or rejection written
A01 Written decision to grant a patent or to grant a registration (utility model)

Free format text: JAPANESE INTERMEDIATE CODE: A01

Effective date: 20210112

A61 First payment of annual fees (during grant procedure)

Free format text: JAPANESE INTERMEDIATE CODE: A61

Effective date: 20210208

R150 Certificate of patent or registration of utility model

Ref document number: 6837064

Country of ref document: JP

Free format text: JAPANESE INTERMEDIATE CODE: R150

R250 Receipt of annual fees

Free format text: JAPANESE INTERMEDIATE CODE: R250

R250 Receipt of annual fees

Free format text: JAPANESE INTERMEDIATE CODE: R250