Patent ID: 8024798
Filing Date: 2011-09-20
Classification: G06F

Abstract:
1. A method for monitoring and protecting a program system against attacks which are based on the intention to write data to a memory segment of a program and to execute these data as a code, the method comprising: identifying whether there is an unsafe combination of Write and Execute rights for the memory segment; deleting one of the Write and Execute rights, if the unsafe combination has been identified; and carrying out the following steps at runtime if the program has been interrupted, examining a reason for which the program has been interrupted, initiating recovery measures if an attack has been identified, exchanging rights if the interruption has been produced by the deletion of a right, and forwarding at least one of monitoring and control to an operating system component if another reason for interruption has been identified, wherein the unsafe combination of the Write and Execute rights includes a simultaneously existence of the Write and Execute rights, and the identifying includes monitoring the memory segment for a presence of the unsafe combination of Write and Execute rights, the monitoring being performed either cyclically or being triggered by an occurrence of configurable events.