Patent ID: 7861305

Claim:
A method for malware detection, wherein the method comprises: utilizing a hardware based program flow monitor (PFM) for embedded software that employs a static analysis of program code; marrying the program code to addresses, while considering which central processing unit (CPU) is executing the program code; capturing an expected control flow of the program code, and storing the control flow as physical address pairs of leaders and followers (LEAD-FOLL pair) in a Metadata Store (MDS) within the PFM; monitoring control flow at runtime by the PFM; comparing runtime control flow with the expected control flow; and wherein the method further comprises: a) receiving a series of instruction addresses fetched by the central processing unit (CPU) into a logic unit (LU) within the PFM; b) latching by the LU of each of the series of instruction addresses placed on an address bus by the CPU on completion of a read operation, and storing the latched address in a register file (RF); c) storing at PFM power up the first address the CPU fetches to a first location in the RF, the highest program address referenced by a Metadata Store (MDS) into a second location in the RF, and latching the next instruction address fetched by the CPU into a third location in the RF; d) performing a lookup of the address contained in the first location in the MDS; e) generating an alarm if the address in the first location is greater than the address stored in the second location; f) generating an alarm if the address in the first location is not found in the MDS; g) generating an alarm if the address in the first location is found in the MDS, but the address in the third location is not listed as a valid follower; h) copying the address in the third location to the first location if the LEAD-FOLL pair is found in the MDS; i) latching by the LU of the next instruction address fetched by the CPU and storing it in the third location; j) repeating steps d-j, until the program code has been fully executed by the PFM.