PATENT CLAIM ANALYSIS

Application Number: 15966358
Application Type: Utility
Filing Date: 2018-04
Publication Date: 2019-02
Patent Classification: ["726", "016000"]

Abstract:
Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.

Claim (Index 15):
A computing device for real-time exploit mitigation, the computing device comprising:\n a processor comprising a processor trace module to (i) generate trace data indicative of control flow of a process of the computing device, (ii) detect a suspected return-oriented programming exploit that is a mispredicted return instruction using the trace data, and (iii) invoke a mispredicted return handler in response to detection of the suspected return-oriented programming exploit; an exploit detector module to (i) determine whether a current shadow stack is valid in response to invocation of the mispredicted return handler, (ii) update the current shadow stack based on the trace data in response to a determination that the current shadow stack is valid, (iii) compute a message authentication code based on the current shadow stack in response to updating of the current shadow stack, (iv) encode the message authentication code using a handler key, wherein the handler key is located in a protected memory region, and (v) output the encoded message authentication code to the trace data; and a security response module to handle the suspected return-oriented programming exploit in response to a determination that the current shadow stack is not valid.

Metadata:
- Claim Count in Document: 35.0
- Percentile: 91.0
- Lexical Diversity: 2.09722
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14670988', '14498075', '15719956', '14498521', '15823118']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2905620316477552
- 35 USC 102 Novelty (BERT): 0.5802627097544065
- Combined Prediction Score: 0.3195320994584203
- Mean Citation Score: 308.82627
- Max Citation Score: 489.57568
- Similarity Product: 439.83747981132507

Labels:
- Claim Label 101: 1
- Claim Label 102: 1
- Claim Label 103: 1
- Claim Label 112: 1
- Combined Label: 1
- Label 101 Adjusted: 1

Dataset: test