中科微点-全球专利检索

  1. Login
  2. Sign Up

Search Results

37 records (took 0.018 seconds)

    Systems, methods, and apparatus for detecting control flow attacks
    3.
    发明授权
    Systems, methods, and apparatus for detecting control flow attacks 有权

    公开(公告)号：US10984096B2

    公开(公告)日：2021-04-20

    申请号：US15938015

    申请日：2018-03-28

    Applicant: Intel Corporation

    Inventor： Koichi Yamada ,  Sevin F. Varoglu ,  Ajay Harikumar ,  Alex Nayshtut

    IPC: G06F21/52 ,  G06F21/55 ,  G06F21/56

    Abstract: After a heuristic event counter in a processor has triggered a performance monitoring interrupt (PMI) when the processor was executing a target program in user mode, and after the processor has switched to kernel mode in response to the PMI, a heuristic event handler automatically performs preliminary analysis in kernel mode, without switching back to user mode, to determine whether heavyweight code analysis is warranted. The preliminary analysis comprises (a) obtaining an instruction pointer (IP) for the target program from a last branch record (LBR) buffer in the processor, (b) using transaction hardware in the processor to determine whether the IP from LBR buffer points to a readable page in memory, and (c) determining that heavyweight code analysis is not warranted in response to a determination that the page pointed to by the IP from LBR buffer is not readable. Other embodiments are described and claimed.

    Systems, Methods, And Apparatus For Detecting Control Flow Attacks
    4.
    发明申请
    Systems, Methods, And Apparatus For Detecting Control Flow Attacks 审中-公开

    公开(公告)号：US20190042730A1

    公开(公告)日：2019-02-07

    申请号：US15938015

    申请日：2018-03-28

    Applicant: Intel Corporation

    Inventor： Koichi Yamada ,  Sevin F. Varoglu ,  Ajay Harikumar ,  Alex Nayshtut

    IPC: G06F21/52 ,  G06F21/56 ,  G06F21/55

    Abstract: After a heuristic event counter in a processor has triggered a performance monitoring interrupt (PMI) when the processor was executing a target program in user mode, and after the processor has switched to kernel mode in response to the PMI, a heuristic event handler automatically performs preliminary analysis in kernel mode, without switching back to user mode, to determine whether heavyweight code analysis is warranted. The preliminary analysis comprises (a) obtaining an instruction pointer (IP) for the target program from a last branch record (LBR) buffer in the processor, (b) using transaction hardware in the processor to determine whether the IP from LBR buffer points to a readable page in memory, and (c) determining that heavyweight code analysis is not warranted in response to a determination that the page pointed to by the IP from LBR buffer is not readable. Other embodiments are described and claimed.

    Method and apparatus for page-level monitoring
    5.
    发明授权
    Method and apparatus for page-level monitoring 有权

    公开(公告)号：US09891936B2

    公开(公告)日：2018-02-13

    申请号：US14039195

    申请日：2013-09-27

    Applicant: Intel Corporation

    Inventor： Jiwei Oliver Lu ,  Koichi Yamada ,  James D. Beany ,  Palaniverlrajan Shanmugavelayutham ,  Bo Zhang

    IPC: G06F12/00 ,  G06F9/455 ,  G06F12/10 ,  G06F12/1027

    CPC classification number: G06F9/4552 ,  G06F12/10 ,  G06F12/1027 ,  G06F2212/682 ,  G06F2212/683

    Abstract: An apparatus and method for page level monitoring are described. For example, one embodiment of a method for monitoring memory pages comprises storing information related to each of a plurality of memory pages including an address identifying a location for a monitor variable for each of the plurality of memory pages in a data structure directly accessible only by a software layer operating at or above a first privilege level; detecting virtual-to-physical page mapping consistency changes or other page modifications to a particular memory page for which information is maintained in the data structure; responsively updating the monitor variable to reflect the consistency changes or page modifications; checking a first monitor variable associated with a first memory page prior to execution of first program code; and refraining from executing the first program code if the first monitor variable indicates consistency changes or page modifications to the first memory page.

    On-demand binary translation state map generation
    6.
    发明授权
    On-demand binary translation state map generation 有权

    公开(公告)号：US11210074B2

    公开(公告)日：2021-12-28

    申请号：US15194262

    申请日：2016-06-27

    Applicant: Intel Corporation

    Inventor： Tugrul Ince ,  Koichi Yamada

    IPC: G06F8/52 ,  G06F9/455

    Abstract: The present disclosure is directed to a system for on-demand binary translation state map generation. Instead of interpreting the native code to be executed, binary translation circuitry (BT circuitry) may execute a binary translation (BT) in place of the native code. When a stop occurs (e.g., due to an interrupt, a modification of the native code, etc.), the BT circuitry may generate a binary translation state map (BT state map) that allows the location of the stop to be mapped back to the native code. Generation of the BT state map may involve determining a location and offset for the stop, performing region formation based on the location, loading instructions from the region (e.g., while accounting for the need to emulate instructions), forming the BT state map based at least on the size of the loaded instructions, and then mapping the stop back to the native code utilizing the offset.

    Methods, systems and apparatus to detect polymorphic malware
    7.
    发明授权
    Methods, systems and apparatus to detect polymorphic malware 有权

    公开(公告)号：US11126721B2

    公开(公告)日：2021-09-21

    申请号：US16021411

    申请日：2018-06-28

    Applicant: Intel Corporation

    Inventor： Alex Nayshtut ,  Vadim Sukhomlinov ,  Koichi Yamada ,  Ajay Harikumar ,  Venkat Gokulrangan

    IPC: H04L29/06 ,  G06F21/56 ,  G06F21/55

    Abstract: The disclosed embodiments generally relate to detecting malware through detection of micro-architectural changes (morphing events) when executing a code at a hardware level (e.g., CPU). An exemplary embodiment relates to a computer system having: a memory circuitry comprising an executable code; a central processing unit (CPU) in communication with the memory circuitry and configured to execute the code; a performance monitoring unit (PMU) associated with the CPU, the PMU configured to detect and count one or more morphing events associated with execution of the code and to determine if the counted number of morphine events exceed a threshold value; and a co-processor configured to initiate a memory scan of the memory circuitry to identify a malware in the code.

    Apparatus and method for architectural performance monitoring in binary translation systems
    9.
    发明授权
    Apparatus and method for architectural performance monitoring in binary translation systems 有权

    公开(公告)号：US10387159B2

    公开(公告)日：2019-08-20

    申请号：US14614264

    申请日：2015-02-04

    Applicant: Intel Corporation

    Inventor： Jason M Agron ,  Polychronis Xekalakis ,  Paul Caprioli ,  Jiwei Oliver Lu ,  Koichi Yamada

    IPC: G06F8/52 ,  G06F9/38 ,  G06F11/34 ,  G06F11/36 ,  G06F9/455

    Abstract: Methods and apparatuses relate to emulating architectural performance monitoring in a binary translation system. In one embodiment, a processor includes an architectural performance counter to maintain an architectural value associated with instruction execution, a register to store the architectural value of the architectural performance counter, binary translation logic to embed an architectural value from the architectural performance counter into a stream of translated instructions having a transactional code region and to store the architectural value into the register, and an execution unit to execute the transactional code region of the stream of translated instructions. The binary translation logic is configured to add the architectural value from the register to the architectural performance counter upon completion of the transactional code region of the stream of translated instructions. In one embodiment, a binary translation system overcomes software incompatibilities by using microarchitectural support to transparently and accurately emulate architectural performance counter behavior.

Patent Agency Ranking