Methods, media and systems for detecting anomalous program executions

DC CAFC

US 8,074,115 B2
Filed: 10/25/2006
Issued: 12/06/2011
Est. Priority Date: 10/25/2005
Status: Active Grant

- Alert
- Pin

First Claim

Patent Images

1. A method for detecting anomalous program executions, comprising:

executing at least a part of a program in an emulator;

comparing a function call made in the emulator to a model of function calls for the at least a part of the program;

identifying the function call as anomalous based on the comparison; and

upon identifying the anomalous function call, notifying an application community that includes a plurality of computers of the anomalous function call.

View all claims

2 Assignments

Timeline View

Assignment View

Litigations

1 Petition

Accused Products

Abstract

Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.

70 Citations

View as Search Results

42 Claims

1. A method for detecting anomalous program executions, comprising:
- executing at least a part of a program in an emulator;
  
  comparing a function call made in the emulator to a model of function calls for the at least a part of the program;
  
  identifying the function call as anomalous based on the comparison; and
  
  upon identifying the anomalous function call, notifying an application community that includes a plurality of computers of the anomalous function call.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
- - 2. The method of claim 1, further comprising creating a combined model from at least two models created using different computers.
  - 3. The method of claim 1, further comprising creating a combined model from at least two models created at different times.
  - 4. The method of claim 1, further comprising modifying the function call so that the function call becomes non-anomalous.
  - 5. The method of claim 1, further comprising generating a virtualized error in response to the function call being identified as being anomalous.
  - 6. The method of claim 1, wherein the comparing compares the function call name and arguments to the model.
  - 7. The method of claim 1, wherein the model reflects normal activity of the at least a part of the program.
  - 8. The method of claim 1, wherein the model reflects attacks against the at least a part of the program.
  - 9. The method of claim 1, further comprising randomly selecting the model as to be used in the comparison from a plurality of different models relating to the program.
  - 10. The method of claim 1, further comprising randomly selecting a portion of the model to be used in the comparison.

11. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting anomalous program executions, comprising:
- executing at least a part of a program in an emulator;
  
  comparing a function call made in the emulator to a model of function calls for the at least a part of the program;
  
  identifying the function call as anomalous based on the comparison; and
  
  upon identifying the anomalous function call, notifying an application community that includes a plurality of computers of the anomalous function call.
- View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19, 20)
- - 12. The medium of claim 11, wherein the method further comprises creating a combined model from at least two models created using different computers.
  - 13. The medium of claim 11, wherein the method further comprises creating a combined model from at least two models created at different times.
  - 14. The medium of claim 11, wherein the method further comprises modifying the function call so that the function call becomes non-anomalous.
  - 15. The medium of claim 11, wherein the method further comprises generating a virtualized error in response to the function call being identified as being anomalous.
  - 16. The medium of claim 11, wherein the comparing compares the function call name and arguments to the model.
  - 17. The medium of claim 11, wherein the model reflects normal activity of the at least a part of the program.
  - 18. The medium of claim 11, wherein the model reflects attacks against the at least a part of the program.
  - 19. The medium of claim 11, wherein the method further comprises randomly selecting the model as to be used in the comparison from a plurality of different models relating to the program.
  - 20. The medium of claim 11, wherein the method further comprises randomly selecting a portion of the model to be used in the comparison.

21. A system for detecting anomalous program executions, comprising:
- a digital processing device that;
  
  executes at least a part of a program in an emulator;
  
  compares a function call made in the emulator to a model of function calls for the at least a part of the program; and
  
  identifies the function call as anomalous based on the comparison; and
  
  upon identifying the anomalous function call, notifies an application community that includes a plurality of computers of the anomalous function call.

22. A method for detecting anomalous program executions, comprising:
- modifying a program to include indicators of program-level function calls being made during execution of the program;
  
  comparing at least one of the indicators of program-level function calls made in an emulator to a model of function calls for at least a part of the program; and
  
  identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
- View Dependent Claims (23, 24, 25, 26, 27, 28, 29, 30, 31)
- - 23. The method of claim 22, further comprising creating a combined model from at least two models created using different computers.
  - 24. The method of claim 22, further comprising creating a combined model from at least two models created at different times.
  - 25. The method of claim 22, further comprising modifying the function call so that the function call becomes non-anomalous.
  - 26. The method of claim 22, further comprising generating a virtualized error in response to the function call being identified as being anomalous.
  - 27. The method of claim 22, wherein the comparing compares the function call name and arguments to the model.
  - 28. The method of claim 22, wherein the model reflects normal activity of the at least a part of the program.
  - 29. The method of claim 22, wherein the model reflects attacks against the at least a part of the program.
  - 30. The method of claim 22, further comprising randomly selecting the model as to be used in the comparison from a plurality of different models relating to the program.
  - 31. The method of claim 22, further comprising randomly selecting a portion of the model to be used in the comparison.

32. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting anomalous program executions, comprising:
- modifying a program to include indicators of program-level function calls being made during execution of the program;
  
  comparing at least one of the indicators of program-level function calls made in an emulator to a model of function calls for at least a part of the program; and
  
  identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.
- View Dependent Claims (33, 34, 35, 36, 37, 38, 39, 40, 41)
- - 33. The medium of claim 32, wherein the method further comprises creating a combined model from at least two models created using different computers.
  - 34. The medium of claim 32, wherein the method further comprises creating a combined model from at least two models created at different times.
  - 35. The medium of claim 32, wherein the method further comprises modifying the function call so that the function call becomes non-anomalous.
  - 36. The medium of claim 32, wherein the method further comprises generating a virtualized error in response to the function call being identified as being anomalous.
  - 37. The medium of claim 32, wherein the comparing compares the function call name and arguments to the model.
  - 38. The medium of claim 32, wherein the model reflects normal activity of the at least a part of the program.
  - 39. The medium of claim 32, wherein the model reflects attacks against the at least a part of the program.
  - 40. The medium of claim 32, wherein the method further comprises randomly selecting the model as to be used in the comparison from a plurality of different models relating to the program.
  - 41. The medium of claim 32, wherein the method further comprises randomly selecting a portion of the model to be used in the comparison.

42. A system for detecting anomalous program executions, comprising:
- a digital processing device that;
  
  modifies a program to include indicators of program-level function calls being made during execution of the program;
  
  compares at least one of the indicators of program-level function calls made in an emulator to a model of function calls for at least a part of the program; and
  
  identifies a function call corresponding to the at least one of the indicators as anomalous based on the comparison.

Specification

Resources

Litigation Campaign Assessment

Litigation Data

Current Assignee
Trustees Of Columbia University In The City Of New York (Columbia University)
Original Assignee
Trustees Of Columbia University In The City Of New York (Columbia University)
Inventors
Stolfo, Salvatore J., Keromytis, Angelos D., Sidiroglou, Stelios
Primary Examiner(s)
Iqbal, Nadeem

Application Number

US12/091,150
Publication Number

US 20100023810A1
Time in Patent Office

1,868 Days
Field of Search

714 2- 10, 714 25- 29, 714/32, 714/33, 714 37- 39, 714/47
US Class Current

714/38.1
CPC Class Codes

G06F 11/0718   in an object-oriented system

G06F 11/0751   Error or fault detection no...

G06F 11/0772   Means for error signaling, ...

G06F 11/079   Root cause analysis, i.e. e...

G06F 11/3652   in-circuit-emulation [ICE] ...

Methods, media and systems for detecting anomalous program executions

First Claim

2 Assignments

Litigations

1 Petition

Accused Products

Abstract

70 Citations

42 Claims

Specification

Solutions

Use Cases

Quick Links

Methods, media and systems for detecting anomalous program executions

First Claim

2 Assignments

Subscription Required

Subscription Required

Litigations

1 Petition

Subscription Required

Accused Products

Subscription Required

Abstract

70 Citations

42 Claims

Specification

Subscription Required

Solutions

Use Cases

Quick Links