Patent Document ID: 9916443
Application ID: 14805408
Patent Status: 1

Claim One:
1. A system for detecting an attempt to exploit a memory allocation vulnerability, comprising: a processor configured to: receive a malware sample; monitor an array operation performed by the malware sample using a memory monitoring component; and determine whether the array operation performed by the malware sample is suspicious, comprising to: perform three or more of the following: A) determine whether a vector size associated with the array operation exceeds a predefined threshold; and in response to a determination that the vector size exceeds the predefined threshold, determine that the malware sample is suspicious; B) compare a vector size associated with the array operation with a corresponding vector size in a size record; and in response to a determination that the vector size associated with the array operation does not match the corresponding vector size in the size record, determine that the malware sample is suspicious; C) compare a structure hash on the array operation with a previously calculated structure hash; and in response to a determination that the structure hash on the array operation does not match the previously calculated structure hash, determine that the malware sample is suspicious; or D) append a cookie at an end of an allocated buffer; compare a pre-stored value associated with the cookie with a current value of the cookie during the array operation; and in response to a determination that the pre-stored value associated with the cookie does not match current value of the cookie during the array operation, determine that the malware sample is suspicious; and a memory coupled to the processor and configured to provide the processor with instructions.