Patent ID: 9372990
Filing Date: 2016-06-21
CPC Classification: G06F

Claim Text:
1. A method for detecting heap spraying on a computer, the method comprising: detecting, by one or more processors, a plurality of requests to allocate portions of heap memory; measuring, by one or more processors, the plurality of requests to determine values of characteristics of the plurality of requests, wherein a value of a first characteristic comprises a number of requests of the plurality of requests whose requested allocations are of a same size, wherein a value of a second characteristic comprises a number of allocation data payloads that have one or more equal bytes at the same byte position, and wherein a value of a third characteristic comprises a number of requests of the plurality of requests that are requests for allocations on executable pages; identifying, by one or more processors, an activity consistent with heap spraying by determining that the values of the characteristics are consistent with benchmark values of the characteristics, wherein the benchmark values of the characteristics are associated with heap spraying; and performing, by one or more processors, a computer-security-related remediation action responsive to determining that the values of the characteristics are consistent with the benchmark values of the characteristics.