Patent ID: 11880453
Assignee: SOPHOS LIMITED
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 0:
1. A computer program product for malware mitigation based on runtime memory allocation behavior, the computer program product comprising computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
instrumenting a compute instance to detour kernel calls for memory management to a detection routine;
detecting, with a first malware check by the detection routine, a first kernel call by a first code segment to allocate a first memory range of a heap memory, wherein the first code segment is executing in the heap memory;
detecting, with a second malware check by the detection routine, a second kernel call to map the first memory range of the heap memory as executable; and
in response to detecting the first kernel call to allocate the first memory range of the heap memory and the second kernel call to map the first memory range as executable, terminating execution of the first code segment executing in the heap memory.