Patent ID: 7607122
Filing Date: 2009-10-20
Classification: G06F

Abstract:
1. A computer-implemented method for detecting whether a computer program has been subject to modification, the method comprising: generating a first data after the computer program build is completed and prior to execution of the computer program that is descriptive of a call tree associated with the program, wherein the call tree defines legitimate sequences of intended function calls within the program; generating a second data during execution of the program that is descriptive of actual function call sequence saved on a stack used by the program; using the first data and the second data during execution of the program to determine whether a return address on the stack is consistent with the call tree by comparing the intended first data function call against the second data function call as saved on the stack by comparing a sequence of return addresses to the sequence of function calls of the call tree; if the return address is consistent with the call tree, then allowing the program to proceed with execution at the return address; and if said return address is not consistent with said call tree, then taking at least one action comprising at least one of a process termination, altering a monitor process, or triggering an exception, to prevent or deter execution of a code referenced by the return address.