Patent ID: 11886585
Assignee: MUSARUBRA US LLC
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 19:
20. A method for detecting malicious position independent code execution, the method comprising:
receiving, via an Application Programming Interface, a notification identifying a newly created thread by a first logic unit stored within a kernel space of a memory;
determining a thread type associated with the newly created thread to determine whether the newly created thread is a predetermined thread type, wherein the predetermined thread type includes a thread created in the kernel space;
extracting, by the first logic unit operating within the kernel space, at least meta-information associated with the newly created thread included as part of the notification when the newly created thread is a thread type other than the predetermined thread type;
receiving at least the meta-information associated with the newly created thread by a second logic unit stored within user space of the memory;
conducting analytics on at least the meta-information by the second logic unit to attempt to classify the newly created thread; and
issuing an alert, as generated by the second logic unit, upon classifying the newly created thread as a cyberattack associated with the malicious position independent code execution based at least on results of the analytics associated with the meta-information associated with the newly created thread.