Computer exploit detection using heap spray pattern matching

摘要

According to one embodiment, a threat detection system is integrated with at least a dynamic analysis engine. The dynamic analysis engine is configured to automatically to detect potential shellcode at a first storage location within a region of memory allocated for an application, conduct a first search at one or more storage locations prior to the first storage location within the region of allocated memory for at least one or more patterns, conduct a second search at one or more storage locations subsequent to the first storage location within the region of allocated memory for at least one or more patterns, detect a first pattern at one or more storage locations prior to the first storage location within the region of allocated memory, and detect a second pattern at one or more storage locations subsequent to the first storage location with the region of allocated memory, wherein at least one of the first pattern or the second pattern is absent from a predefined list of patterns.

主权项

1. A computerized method, comprising:
determining whether an amount of memory allocated for an application exceeds a predetermined threshold; responsive to determining the amount of allocated memory exceeds the predetermined threshold, scanning a region of the allocated memory for a predefined number of a first pattern, wherein the predefined number appears in a contiguous manner, the region being less than an entirety of the allocated memory; and responsive to detecting at least the predefined number of the first pattern in the contiguous manner, scanning a remainder of the allocated memory for a sequence of a first No Operation (NOP) sled and potential shellcode, wherein the remainder of the allocated memory excludes a subset of the allocated memory a Read permission from the scanning of the region of the allocated memory for the predefined number of the first pattern, and the subset being less than an entirety of the allocated memory.