Patent ID: 11880453
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 19:
20. A system comprising:
a processor and a physical memory;
an operating system stored in the physical memory and configured to execute on the processor, the operating system configured to provide access to a heap memory including at least memory allocations of the heap memory and controlling memory permissions for the heap memory;
a detection routine executing on the processor and configured to detour memory management calls to a kernel of the operating system; and
a malware detection process configured to terminate execution of code executing in the heap memory when detecting with the detection routine that the code allocates additional memory within the heap memory based on a first detour of at least one kernel call to allocate memory, and when further detecting that the code enables execute access to the additional memory based on a second detour of at least one other kernel call to control memory permissions.