Patent ID: 8904537
Filing Date: 2014-12-02
Classification: G06F,H04L

Abstract:
1. A method of detecting malware, the method comprising: at a computer device having an operating system and a memory, executing an untrusted computer program in a sandbox environment; and in the event that the untrusted program directly accesses a region of the memory used to store information relating to the operating system, determining that the trusted program is likely to be malware, the method further comprising: marking regions of the memory used to store information relating to the operating system; and monitoring direct access to the marked regions of the memory by the untrusted program, wherein a marked region of the memory includes any of: a region that is automatically initialized by the operating system; a region that is allocated by a call to a system library that returns a data structure that should not be accessed directly; a region that is allocated by the untrusted program and passed as a parameter to a system function; a region that includes local variables and passed as a parameter to a system function; a region relating to code in shared libraries that are part of the operating system; and a region relating to a volatile register value created from the return of an application programming interface call; the method further comprising: in the event that the memory region is marked owing to allocation by a call to a system library that returns a data structure that should not be accessed directly, removing the marking when a request is made to free the memory.