Patent ID: 8645923

Claim:
A computer implemented method for enforcing control flow in an execution of a program, the method comprising the steps of: preventing, by a computer, jumps between code pages in the execution of a program until verified against a control flow graph by setting all code pages of the program except a code page containing an entry point to be non-executable; causing, by a computer, an exception handler to process an exception responsive to each attempted jump between code pages, and prior to execution of a destination code page; responsive to an exception resulting from an attempted jump between code pages in the execution of the program, processing, by a computer, the exception by referring to the control flow graph concerning the program to determine whether the attempted jump between code pages is expected according to the control flow graph; and responsive to at least whether the attempted jump between code pages is expected according to the control flow graph, determining, by a computer, whether the program is attempting a malicious action.